medium5.4
CVE-2026-9308
Firefox for iOS Reader View replaced page content in its HTML template before replacing other internal placeholders.
Impact
Firefox for iOS Reader View replaced page content in its HTML template before replacing other internal placeholders. A malicious page could include a placeholder string that was later substituted with JSON-LD data, potentially resulting in arbitrary JavaScript execution. This vulnerability was fixed in Firefox for iOS 151.2.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Mozilla | Firefox | before 151.2 |