8.8
HighCVSS 3.1 · from CISA
CVE-2026-103418
Universal XSS via the HTML language attribute in Translation Services
Firefox for iOS · Cross-site scripting · CWE-79AffectedFirefox for iOS
FixUpdate to 157.1 or newer
PublishedOct 13, 07:19 · mozilla
Scored8.8 · CISA
Exploit code publicNone known · checked 21:18 UTC
ExploitedNone known · CISA KEV checked 22:08 UTC
What we know
No known exploitation. CISA KEV, checked 22:08 UTC.
No public exploit code known. Exploit-DB, Metasploit, Nuclei, checked 21:18 UTC.
An attacker only needs network access to the target. No login needed. CVSS: network, no privileges.
Someone has to open, click or run something first. CVSS: user interaction required.
A successful attack can read and change data and take the service down. CVSS: high impact on confidentiality, integrity and availability.
A successful attack gives full control of the affected system. CISA: technical impact total.
Description
Firefox for iOS directly interpolated the page’s HTML language attribute into translation JavaScript, allowing attacker-controlled markup to execute code in Firefox’s privileged content world and bypass the page’s Content Security Policy. This vulnerability was fixed in Firefox for iOS 157.1.
From mozilla
Affected and fixed versions
ProductAffectedFixed inFirefox for iOSNot affected157.1
Exploit code
Exploit-DBnone knownMetasploitnone knownNucleinone known