CVE-2026-116632 in Firefox for iOS
Summary
by MITRE • 10/26/2026
A malicious web page could insert arbitrary text into the FaceTime call prompt shown by iOS, potentialy allowing it to display a phishing message inside system UI. This vulnerability was fixed in Firefox for iOS 156.1.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/26/2026
The identified vulnerability represents a significant security flaw within the integration of web content and native operating system interfaces on Apple's iOS platform, specifically affecting how Firefox handles FaceTime call prompts. The core technical issue stems from an improper validation or sanitization process when rendering user-supplied input that triggers system-level UI elements. In this specific instance, a maliciously crafted webpage was able to inject arbitrary text directly into the native FaceTime call prompt dialog box displayed by iOS. This behavior indicates a failure in the boundary between web content and privileged system components, allowing untrusted data from a third-party website to be interpreted as part of the trusted operating system interface without adequate filtering or encoding checks.
From an operational perspective, this flaw enables a sophisticated phishing attack vector that bypasses traditional user awareness mechanisms. By embedding deceptive text within a legitimate-looking FaceTime call prompt, attackers can create a high-fidelity social engineering trap. Users typically trust native iOS UI elements as authoritative and secure; therefore, seeing a malicious message inside such a familiar interface significantly increases the likelihood of user interaction with harmful content or credentials harvesting attempts. This undermines the principle of least privilege by allowing web-based actors to manipulate system-level notifications in ways that mimic legitimate communication requests, potentially leading users to disclose sensitive information under false pretenses.
This vulnerability aligns closely with CWE-79, which describes Cross-Site Scripting (XSS) involving improper neutralization of input during web page generation, although it extends beyond standard DOM manipulation into native UI injection. It also relates to CWE-20, Improper Input Validation, as the application failed to correctly validate or sanitize the data before passing it to the system prompt handler. In terms of threat modeling and adversary tactics, this behavior is consistent with ATT&CK technique T1568.002, Dynamic Resolution, where attackers use infrastructure that changes frequently to evade detection, but more specifically, it reflects aspects of social engineering through UI spoofing, which falls under the broader category of user interaction manipulation often seen in advanced persistent threats or targeted phishing campaigns designed to exploit trust in platform-native features.
The resolution of this issue in Firefox for iOS version 156.1 highlights the importance of rigorous input sanitization and strict separation between web content rendering engines and native OS API calls. Mitigation strategies involve implementing robust data validation layers that ensure any text intended for display within system prompts is strictly controlled and free from malicious payloads or unexpected formatting characters. Developers must treat all user-supplied strings as untrusted, applying context-specific encoding before passing them to native interfaces. Furthermore, security audits should focus on identifying other instances where web content influences privileged UI elements, ensuring that the trust boundary between browser-rendered pages and operating system dialogs is maintained through strict parameterization and validation protocols rather than relying solely on user vigilance or superficial checks.