CVE-2026-103418 in Firefox for iOS
Summary
by MITRE • 10/13/2026
Firefox for iOS directly interpolated the page’s HTML language attribute into translation JavaScript, allowing attacker-controlled markup to execute code in Firefox’s privileged content world and bypass the page’s Content Security Policy. This vulnerability was fixed in Firefox for iOS 157.1.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/13/2026
The identified vulnerability represents a critical failure in input validation and context switching within the Mozilla Firefox browser engine on iOS, specifically involving the handling of HTML language attributes during automatic translation processes. The core technical flaw stems from the direct interpolation of user-controlled or attacker-modified content into JavaScript execution contexts without adequate sanitization or encoding. When Firefox for iOS attempts to translate a webpage, it parses the document's structure and extracts metadata such as the lang attribute. Instead of treating this value strictly as data, the browser engine incorrectly treats portions of it as executable code within its privileged content world. This architectural misstep allows an attacker who can control the HTML language attribute or inject malicious markup into that field to execute arbitrary JavaScript commands with elevated privileges relative to the standard web page context.
This specific flaw facilitates a bypass of Content Security Policy (CSP) directives, which are designed to mitigate cross-site scripting and other code injection attacks by restricting the sources from which scripts can be loaded and executed. By injecting malicious markup into the language attribute, an attacker effectively tricks the browser's translation subsystem into executing that content in a context where CSP restrictions do not apply or are improperly enforced. This results in a privilege escalation scenario where untrusted web content gains access to internal browser APIs and data structures that should remain isolated from standard webpage scripts. The ability to execute code in the privileged content world means that an attacker can potentially read sensitive cookies, manipulate DOM elements beyond what is permitted by CSP, or interact with other tabs if session isolation mechanisms are compromised due to this injection vector.
From a threat modeling perspective, this vulnerability aligns closely with CWE-79, which describes Improper Neutralization of Input During Web Page Generation commonly known as Cross-site Scripting (XSS). More specifically, it relates to CWE-829 because the execution occurs in an out-of-band or privileged context rather than just within the sandboxed webpage. In terms of MITRE ATT&CK tactics, this behavior corresponds to Execution techniques where attackers leverage trusted applications and system processes to run malicious code. The exploitation path typically involves crafting a specially designed web page that forces Firefox for iOS to trigger its translation feature while supplying the malformed language attribute. Upon loading such a page, the browser's internal logic fails to distinguish between safe string data and executable script fragments, leading to immediate code execution upon initialization of the translation service.
The operational impact of this vulnerability is severe due to the potential for session hijacking, credential theft, and further lateral movement within the user’s browsing environment. Since Firefox on iOS often handles sensitive financial or personal information, an attacker could exploit this flaw to steal authentication tokens stored in memory or intercept data intended for secure APIs. Furthermore, because the code executes with higher privileges than standard webpage scripts, it may allow persistence mechanisms or deeper system access depending on how the privileged content world interfaces with native iOS components. This undermines the fundamental security model of web browsers which relies heavily on strict separation between untrusted web content and trusted browser internals.
Mitigation for this issue was implemented in Firefox for iOS version 157.1 through rigorous input validation and context isolation improvements. The fix ensures that any data derived from HTML attributes, particularly those involved in translation logic, is strictly treated as text strings rather than executable code. Developers likely introduced additional sanitization layers to escape special characters and enforced stricter CSP enforcement even within the translation subsystem's execution environment. Users are strongly advised to update their Firefox for iOS application immediately to version 157.1 or later to close this attack vector. Additionally, security teams should monitor browser telemetry for unusual script executions originating from translation services and ensure that future development cycles include automated fuzzing tests targeting attribute-based injection points in all parsing engines.