CVE-2026-14906
published 2026-07-13CVE-2026-14906: Pages with malicious titles could potentially allow saved PDF content to overwrite PDF files or bundled content within the Firefox for iOS application sandbox…
PriorityP426medium5.3CVSS 3.1
AVNACLPRNUINSUCLINAN
EPSS
0.18%
7.4th percentile
Pages with malicious titles could potentially allow saved PDF content to overwrite PDF files or bundled content within the Firefox for iOS application sandbox. This vulnerability was fixed in Firefox for iOS 152.4.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| mozilla | firefox_for_ios | < Firefox for iOS 152.4 | Firefox for iOS 152.4 |
| mozilla | firefox_mobile | < 152.4 | 152.4 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Pages with malicious titles could potentially allow saved PDF content to overwrite PDF files or bundled content within the Firefox for iOS application sandbox.
ghsa_unreviewed·2026-07-13
CVE-2026-14906 [MEDIUM] CWE-434 Pages with malicious titles could potentially allow saved PDF content to overwrite PDF files or bundled content within the Firefox for iOS application sandbox.
Pages with malicious titles could potentially allow saved PDF content to overwrite PDF files or bundled content within the Firefox for iOS application sandbox. This vulnerability was fixed in Firefox for iOS 152.4.
VulDB
Mozilla Firefox up to 152.3 on iOS PDF File sandbox
vuldb·2026-07-13·CVSS 5.3
CVE-2026-14906 [MEDIUM] Mozilla Firefox up to 152.3 on iOS PDF File sandbox
A vulnerability labeled as critical has been found in Mozilla Firefox up to 152.3 on iOS. This vulnerability affects unknown code of the component PDF File Handler. The manipulation results in sandbox issue.
This vulnerability is known as CVE-2026-14906. It is possible to launch the attack remotely. No exploit is available.
Mozilla
Mozilla Foundation Security Advisory 2026-66: CVE-2026-14906
vendor_mozilla·CVSS 5.3
CVE-2026-14906 [MEDIUM] Mozilla Foundation Security Advisory 2026-66: CVE-2026-14906
Mozilla Foundation Security Advisory 2026-66
CVE: CVE-2026-14906
Product: Firefox for iOS
Impact: low
Fixed in: Firefox for iOS 152.4
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-07-13
Published