CVE-2026-86853 in Firefox for iOS
Summary
by MITRE • 09/08/2026
A malicious webpage could repeatedly trigger external URL schemes, causing system prompts or external application launches. This could make Firefox for iOS temporarily unusable until the page is closed. This vulnerability was fixed in Firefox for iOS 155.1.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 09/08/2026
The identified security issue pertains to a denial of service condition within Mozilla Firefox for iOS, specifically affecting versions prior to 155.1. The core technical flaw involves an improper handling of external URL schemes triggered by malicious web content. When a webpage executes code designed to repeatedly invoke these external protocols, the browser fails to implement adequate rate limiting or resource management mechanisms to handle such rapid-fire requests. This lack of control leads to a cascade of system-level interactions that overwhelm the application's ability to process events efficiently.
From an operational perspective, this vulnerability results in significant user experience degradation and potential service disruption. The repeated triggering of external URL schemes causes iOS to generate persistent system prompts or initiate launches for associated applications registered with those protocols. These interruptions consume substantial processing resources and block the main UI thread, rendering Firefox temporarily unusable. Users are forced to manually close the affected tab or application to restore functionality, which constitutes a classic denial of service scenario where availability is compromised without requiring privilege escalation or data exfiltration.
This vulnerability aligns with CWE-400, Uncontrolled Resource Consumption, as the application fails to restrict the amount of resources consumed by external inputs. Furthermore, it relates to CWE-829, Inclusion of Functionality from Outside Control, because the browser relies on external system behaviors triggered by web content without sufficient validation or throttling. In terms of threat modeling and adversary tactics, this behavior mirrors techniques found in MITRE ATT&CK under T1566.001, Phishing: Spearphishing Attachment, where malicious links are used to trigger unintended actions, although here the primary impact is disruption rather than initial access. The repeated nature of the attack also reflects aspects of automated exploitation strategies aimed at destabilizing target environments through resource exhaustion.
The resolution for this issue was implemented in Firefox for iOS version 155.1. Mitigation primarily involves updating to this patched version, which introduces safeguards against excessive external protocol invocations. For organizations deploying Firefox on managed devices, ensuring that endpoint management policies enforce the latest stable release is critical. Additionally, users should be advised to exercise caution when interacting with untrusted web content and to monitor application behavior for signs of resource exhaustion or unexpected system prompts. While this specific vulnerability does not lead to remote code execution or data theft, its potential to disrupt workflow makes it a significant concern in environments where browser availability is essential for productivity.