5.5
MediumCVSS 3.1 · from CISA
CVE-2026-103417
Saved credentials can be autofilled after cross-origin navigation
Firefox for iOS · CWE-346 · CWE-346AffectedFirefox for iOS
FixUpdate to 157.1 or newer
PublishedOct 13, 07:19 · mozilla
Scored5.5 · CISA
Exploit code publicNone known · checked 21:18 UTC
ExploitedNone known · CISA KEV checked 22:10 UTC
What we know
No known exploitation. CISA KEV, checked 22:10 UTC.
No public exploit code known. Exploit-DB, Metasploit, Nuclei, checked 21:18 UTC.
An attacker needs local access to the machine. CVSS: local.
Someone has to open, click or run something first. CVSS: user interaction required.
A successful attack can read data. CVSS impact.
Description
Firefox for iOS could autofill saved credentials into a new page if cross-origin navigation occurred while the saved-login UI was open. Autofill was not bound to the originating page or rejected when its origin changed. This vulnerability was fixed in Firefox for iOS 157.1.
From mozilla
Affected and fixed versions
ProductAffectedFixed inFirefox for iOSNot affected157.1
Exploit code
Exploit-DBnone knownMetasploitnone knownNucleinone known