CVE-2026-103417
published 2026-10-13CVE-2026-103417: Firefox for iOS could autofill saved credentials into a new page if cross-origin navigation occurred while the saved-login UI was open. Autofill was not bound…
PriorityP421medium5.5CVSS 3.1
AVLACLPRNUIRSUCHINAN
EPSS
0.08%
0.1th percentile
Firefox for iOS could autofill saved credentials into a new page if cross-origin navigation occurred while the saved-login UI was open. Autofill was not bound to the originating page or rejected when its origin changed. This vulnerability was fixed in Firefox for iOS 157.1.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| mozilla | firefox_for_ios | < Firefox for iOS 157.1 | Firefox for iOS 157.1 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Mozilla
Mozilla Foundation Security Advisory 2026-105: CVE-2026-103417
vendor_mozilla·CVSS 5.5
CVE-2026-103417 [MEDIUM] Mozilla Foundation Security Advisory 2026-105: CVE-2026-103417
Mozilla Foundation Security Advisory 2026-105
CVE: CVE-2026-103417
Product: Firefox for iOS
Impact: moderate
Fixed in: Firefox for iOS 157.1
GHSA
Firefox for iOS could autofill saved credentials into a new page if cross-origin navigation occurred while the saved-login UI was open.
ghsa_unreviewed·2026-10-13
CVE-2026-103417 [MEDIUM] CWE-346 Firefox for iOS could autofill saved credentials into a new page if cross-origin navigation occurred while the saved-login UI was open.
Firefox for iOS could autofill saved credentials into a new page if cross-origin navigation occurred while the saved-login UI was open. Autofill was not bound to the originating page or rejected when its origin changed. This vulnerability was fixed in Firefox for iOS 157.1.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-10-13
Published