PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-9309 Mozilla CVE debrief

A medium-severity cross-site scripting vulnerability in Firefox for iOS Reader View allowed malicious pages to inject unescaped HTML via JSON-LD metadata. The injected markup could alter Reader View behavior and exfiltrate sensitive URL parameters, which could then be leveraged to access internal pages and achieve arbitrary JavaScript execution in an internal origin. Mozilla fixed this issue in Firefox for iOS 151.2.

Vendor
Mozilla
Product
Firefox for iOS
CVSS
MEDIUM 5.4
CISA KEV
Not listed in stored evidence
Original CVE published
2026-06-01
Original CVE updated
2026-07-22
Advisory published
2026-06-01
Advisory updated
2026-07-22

Who should care

Organizations with mobile workforces using Firefox for iOS, security teams managing mobile browser configurations, and users who rely on Reader View for content consumption.

Technical summary

Firefox for iOS Reader View failed to properly escape HTML tags embedded in JSON-LD metadata. A malicious web page could supply crafted JSON-LD containing unescaped markup. When a user activated Reader View, the injected markup would execute in the Reader View context, altering its behavior and extracting sensitive URL parameters. Those parameters could then be used to reach internal browser pages, ultimately permitting arbitrary JavaScript execution in an internal origin. The vulnerability is classified as CWE-79 and scored CVSS 3.1 5.4 (Medium).

Defensive priority

medium

Recommended defensive actions

  • Upgrade Firefox for iOS to version 151.2 or later.
  • If upgrade is delayed, avoid using Reader View on untrusted or suspicious websites.
  • Monitor for unexpected internal-page navigation or parameter leakage in Firefox for iOS logs.
  • Review mobile device management policies to enforce minimum browser versions.

Evidence notes

The NVD record lists CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N and CWE-79 (Improper Neutralization of Input During Web Page Generation). Mozilla's security advisory MFSA2026-53 and Bugzilla bug 2036573 are cited as primary sources.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-9309 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-9309

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-9309 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-9309

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.