PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-9078 Mozilla CVE debrief

CVE-2026-9078 is a visual spoofing vulnerability in Firefox for iOS affecting link preview UI surfaces. The issue involves incorrect display of specially crafted right-to-left (RTL) and internationalized domain names (IDNs), where a malicious RTL hostname could visually reorder portions of the displayed domain to make attacker-controlled sites appear as trusted origins. This represents a user interface deception attack that could facilitate phishing by misleading users about the true destination of a link. The vulnerability was remediated in Firefox for iOS version 151.1. The CVSS 3.1 score of 5.4 (MEDIUM) reflects network attack vector, low attack complexity, no required privileges, required user interaction, and impacts to confidentiality and availability. The weakness is classified as CWE-451 (User Interface (UI) Misrepresentation of Critical Information).

Vendor
Mozilla
Product
Firefox for iOS
CVSS
MEDIUM 5.4
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-25
Original CVE updated
2026-05-26
Advisory published
2026-05-25
Advisory updated
2026-05-26

Who should care

Mobile security teams, iOS enterprise administrators, phishing awareness training programs, and organizations with bring-your-own-device policies involving Firefox for iOS should prioritize this update. Security awareness teams should incorporate visual spoofing techniques into user education given the social engineering nature of this attack vector.

Technical summary

The vulnerability stems from improper handling of bidirectional text and internationalized domain names in Firefox for iOS link preview interfaces. When displaying hostnames containing RTL characters, the UI fails to properly isolate or normalize the text direction, allowing visual reordering that can obscure the true domain structure. This UI misrepresentation (CWE-451) enables attackers to craft domains where the displayed preview suggests a trusted origin while the actual resolved destination is attacker-controlled. The attack requires user interaction to trigger the link preview and does not require elevated privileges.

Defensive priority

medium

Recommended defensive actions

  • Update Firefox for iOS to version 151.1 or later to remediate this vulnerability
  • Educate users to verify link destinations through multiple UI indicators rather than relying solely on preview text
  • Consider implementing additional domain verification controls for mobile browser deployments
  • Monitor for phishing campaigns that may attempt to exploit visual spoofing techniques in mobile browsers

Evidence notes

Vulnerability description and remediation version derived from official CVE record and Mozilla security advisory. CVSS vector and CWE classification sourced from NVD entry. Vendor attribution to Mozilla supported by source references from [email protected] including Bugzilla bug 2029371 and MFSA2026-52.

Official resources

2026-05-25