MajorCritical vulnerability

CVE-2026-103418 (CVSS 8.8)

NVD · officialPublished Oct 13, 2026Risk 37/100EPSS 0.2%

Firefox for iOS directly interpolated the page’s HTML language attribute into translation JavaScript, allowing attacker-controlled markup to execute code in Firefox’s privileged content world and bypass the page’s Content Security Policy. This vulnerability was fixed in Firefox for iOS 157.1.

Technical details

CVSS

8.8

AV:NetworkAC:LowPR:NoneUI:RequiredC:HighI:HighA:High

Evidence and sources

This record is attributed to NVD. Exploitation status and remediation guidance are kept separate from the vulnerability's technical severity.

Open primary source