PatchSiren cyber security CVE debrief
CVE-2026-9078 Mozilla CVE debrief
CVE-2026-9078 is a visual spoofing vulnerability in Firefox for iOS affecting link preview UI surfaces. The issue involves incorrect display of specially crafted right-to-left (RTL) and internationalized domain names (IDNs), where a malicious RTL hostname could visually reorder portions of the displayed domain to make attacker-controlled sites appear as trusted origins. This represents a user interface deception attack that could facilitate phishing by misleading users about the true destination of a link. The vulnerability was remediated in Firefox for iOS version 151.1. The CVSS 3.1 score of 5.4 (MEDIUM) reflects network attack vector, low attack complexity, no required privileges, required user interaction, and impacts to confidentiality and availability. The weakness is classified as CWE-451 (User Interface (UI) Misrepresentation of Critical Information).
- Vendor
- Mozilla
- Product
- Firefox for iOS
- CVSS
- MEDIUM 5.4
- CISA KEV
- Not listed in stored evidence
- Original CVE published
- 2026-05-25
- Original CVE updated
- 2026-05-26
- Advisory published
- 2026-05-25
- Advisory updated
- 2026-05-26
Who should care
Mobile security teams, iOS enterprise administrators, phishing awareness training programs, and organizations with bring-your-own-device policies involving Firefox for iOS should prioritize this update. Security awareness teams should incorporate visual spoofing techniques into user education given the social engineering nature of this attack vector.
Technical summary
The vulnerability stems from improper handling of bidirectional text and internationalized domain names in Firefox for iOS link preview interfaces. When displaying hostnames containing RTL characters, the UI fails to properly isolate or normalize the text direction, allowing visual reordering that can obscure the true domain structure. This UI misrepresentation (CWE-451) enables attackers to craft domains where the displayed preview suggests a trusted origin while the actual resolved destination is attacker-controlled. The attack requires user interaction to trigger the link preview and does not require elevated privileges.
Defensive priority
medium
Recommended defensive actions
- Update Firefox for iOS to version 151.1 or later to remediate this vulnerability
- Educate users to verify link destinations through multiple UI indicators rather than relying solely on preview text
- Consider implementing additional domain verification controls for mobile browser deployments
- Monitor for phishing campaigns that may attempt to exploit visual spoofing techniques in mobile browsers
Evidence notes
Vulnerability description and remediation version derived from official CVE record and Mozilla security advisory. CVSS vector and CWE classification sourced from NVD entry. Vendor attribution to Mozilla supported by source references from [email protected] including Bugzilla bug 2029371 and MFSA2026-52.
Official resources
2026-05-25