CVE-2026-116631 in Firefox for iOS
Summary
by MITRE • 10/26/2026
A malicious web page could open a tel link in a window that was showing a different website, causing the phone-call prompt to appear as if that site had requested the call. This vulnerability was fixed in Firefox for iOS 156.1.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/26/2026
The identified vulnerability represents a sophisticated social engineering attack vector facilitated by improper handling of URI schemes within mobile web browsers, specifically affecting Firefox for iOS prior to version 156.1. The core technical flaw lies in the browser's window management and user interface state preservation when processing external protocol handlers such as tel links. When an attacker constructs a malicious webpage that triggers a telephone call via a tel link, they can manipulate the browsing context by opening this action within a specific window or tab configuration while another website is actively displayed on the screen. This manipulation results in a deceptive visual presentation where the system-level phone-call prompt appears to originate from the legitimate site currently visible to the user rather than the malicious background page that initiated it.
This behavior exploits the psychological trust users place in established websites and browser interfaces, creating a scenario known as UI redressing or clickjacking variant specific to mobile operating systems. By masking the true origin of the request, the attacker obscures the fact that an untrusted third-party script is attempting to initiate communication with the user's phone number. The vulnerability relies on the asynchronous nature of web page loading and window focus events, allowing the malicious code to execute its intent while maintaining a facade of legitimacy through the active tab or view presented by the browser interface. This misalignment between the visual context and the actual source of the system request constitutes a significant breach in user awareness mechanisms designed to prevent unauthorized actions.
From an operational impact perspective, this vulnerability enables attackers to trick users into making expensive international calls, subscribing to premium rate services, or simply wasting mobile data without explicit consent. The deception is particularly dangerous because it bypasses standard security warnings that typically appear when external applications are invoked from a web context. Users may inadvertently authorize charges or reveal personal information if the subsequent call connects them to malicious entities who can then engage in further social engineering attacks based on the initial contact. The impact extends beyond financial loss, potentially compromising user privacy and trust in mobile browsing environments where users expect clear separation between different website contexts.
The remediation for this issue was implemented in Firefox for iOS version 156.1 by enforcing stricter isolation of URI scheme handlers from the visual context of other web pages. This fix ensures that when a tel link is activated, the browser clearly attributes the action to its true source or prevents the deceptive overlay entirely. To mitigate similar risks across broader ecosystems, developers should adhere to strict content security policies and ensure that all external protocol requests are accompanied by unambiguous user consent mechanisms that do not rely on visual context alone. Security practitioners should advise users to keep their browsers updated to the latest stable releases and to exercise caution when interacting with links from untrusted sources, particularly those involving communication protocols like tel or mailto.
This vulnerability aligns with CWE-20 Improper Input Validation regarding the handling of external protocol schemes and falls under ATT&CK technique T1566.001 Phishing: Spearphishing Attachment if used in conjunction with malicious payloads, though more accurately it maps to social engineering tactics involving UI deception. The fix emphasizes the importance of maintaining clear boundaries between browser contexts and system-level interactions to preserve user intent and prevent unauthorized actions driven by deceptive visual cues.