CVE-2026-8706: Firefox for iOS hosted Reader mode on an unauthenticated local web server, allowing another application on the same device to request arbitrary URLs and…

medium6.5CVSS 3.1

AVAACLPRNUINSUCHINAN

Firefox for iOS hosted Reader mode on an unauthenticated local web server, allowing another application on the same device to request arbitrary URLs and receive the response rendered with the signed-in user's cookies. This vulnerability was fixed in Firefox for iOS 151.0.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
mozilla	firefox	< 151.0	151.0
mozilla	firefox_for_ios	< Firefox for iOS 151	Firefox for iOS 151