External protocol handler (tel:) address bar spoof

Firefox for iOS · CWE-451 · CWE-451

AffectedFirefox for iOS

FixUpdate to 156.1 or newer

PublishedOct 26, 18:32 · mozilla

Scored5.4 · CISA

Exploit code publicNone known · checked 22:18 UTC

ExploitedNone known · CISA KEV checked 22:30 UTC

What we know

No known exploitation. CISA KEV, checked 22:30 UTC.

No public exploit code known. Exploit-DB, Metasploit, Nuclei, checked 22:18 UTC.

An attacker only needs network access to the target. No login needed. CVSS: network, no privileges.

Someone has to open, click or run something first. CVSS: user interaction required.

Description

A malicious web page could open a tel link in a window that was showing a different website, causing the phone-call prompt to appear as if that site had requested the call. This vulnerability was fixed in Firefox for iOS 156.1.

From mozilla

Affected and fixed versions

ProductAffectedFixed inFirefox for iOSNot affected156.1

Exploit code

Exploit-DBnone knownMetasploitnone knownNucleinone known

References

bugzilla.mozilla.org/show_bug.cgi?id=1297353 · bugzilla.mozilla.org www.mozilla.org/security/advisories/mfsa2026-117/ · mozilla.org

Other CVEs in Firefox for iOS

All 59 →

5.4Facetime protocol handler enabled spoofing · CVE-2026-116632Oct 26 5.5Saved credentials can be autofilled after cross-origin navigation · CVE-2026-103417Oct 13 8.8Universal XSS via the HTML language attribute in Translation Services · CVE-2026-103418Oct 13