CVE-2026-14906 Mozilla CVE debrief

Who should care

Users of Firefox for iOS, especially those who open PDFs from untrusted sources, should update to version 152.4 to mitigate this vulnerability. This vulnerability could potentially allow saved PDF content to overwrite PDF files or bundled content within the application sandbox, leading to unintended consequences. Users should be cautious when handling PDFs and ensure they are using the latest version of the application.

Technical summary

CVE-2026-14906 is a medium-severity vulnerability in Firefox for iOS. Pages with malicious titles could potentially allow saved PDF content to overwrite PDF files or bundled content within the Firefox for iOS application sandbox. The vulnerability was fixed in Firefox for iOS 152.4. This issue highlights the importance of keeping the application up-to-date, especially for users who handle PDFs from untrusted sources.

Defensive priority

Medium priority for Firefox for iOS users, especially those who handle PDFs from various sources.

Recommended defensive actions

• Update Firefox for iOS to version 152.4 or later
• Be cautious when opening PDFs from untrusted sources
• Monitor for any suspicious activity related to PDF handling in the Firefox for iOS application
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record was published on 2026-07-13T19:16:46.200Z and last modified on 2026-07-13T20:16:42.743Z. The NVD entry is currently Awaiting Analysis. This vulnerability affects Firefox for iOS, specifically versions prior to 152.4. The vulnerability allows saved PDF content to overwrite PDF files or bundled content within the application sandbox if a user opens a maliciously titled page. Evidence is limited, and defenders should verify the affected scope and vendor guidance.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.