CVE-2026-103418
UNKNOWN
NVD
CVSS Score
0
Severity
UNKNOWN
Published
Oct 13, 2026
Vendor
unknown
Description
Firefox for iOS directly interpolated the page’s HTML language attribute into translation JavaScript, allowing attacker-controlled markup to execute code in Firefox’s privileged content world and bypass the page’s Content Security Policy. This vulnerability was fixed in Firefox for iOS 157.1.