Mozilla Firefox for iOS: Universal XSS via HTML language attribute in translation

Summary

Firefox for iOS inserted the HTML language attribute of a web page without proper handling into the JavaScript of its translation feature. An attacker who lures a user to a malicious page and the user then uses the translation function can run code in Firefox's privileged content context and bypass the page's Content Security Policy. Mozilla fixed the issue in Firefox for iOS 157.1; the NVD status is Deferred and the CVSS and CWE values differ between sources.

Affected

• Mozilla Firefox for iOS before 157.1 (CVE record: unaffected from 157.1; VulDB lists up to 157.0)

Fixed in

• Firefox for iOS 157.1 (MFSA 2026-105, announced October 5, 2026)

Workaround

Unknown.

Exploitation

• Not known to be exploited in the wild.
• CISA SSVC: exploitation none, automatable no, technical impact total.
• No public proof of concept found; the Bugzilla entry was not accessible for verification.

Our recommendation

• Update Firefox for iOS on all iPhones and iPads to 157.1 or later and confirm that automatic updates are enabled.
• Prioritise devices used for email, banking or cloud administration.
• Verify the CVSS score and CWE against the NVD record before relying on them.
• The same advisory also fixes CVE-2026-103417 (autofill after cross-origin navigation).

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Mozilla Security Advisory MFSA 2026-105 www.mozilla.org
• Mozilla Bugzilla bug 2062109 bugzilla.mozilla.org
• Mozilla Security Advisories index www.mozilla.org
• VulDB entry 417476 vuldb.com
• Strix CVE-2026-103418 www.strix.ai
• HKCERT security bulletin on Mozilla products www.hkcert.org

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 20:15.