CVE-2026-9078

Firefox for iOS displayed specially crafted right-to-left (RTL) and internationalized domain names (IDNs) incorrectly in link preview UI surfaces. A crafted RTL hostname could visually reorder portions of the displayed domain, causing attacker-controlled sites to appear as trusted origins. This vulnerability was fixed in Firefox for iOS 151.1.

CVSS v3 5.4 MEDIUM

5.4^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 2.5

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact LOW

Scope UNCHANGED

References

Link	Resource
https://bugzilla.mozilla.org/show_bug.cgi?id=2029371	Permissions Required
https://www.mozilla.org/security/advisories/mfsa2026-52/	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:mozilla:firefox:*:*:*:*:*:iphone_os:*:*

History

No history.

Information

Published : 2026-05-25 15:16

Updated : 2026-07-23 11:10

NVD link : CVE-2026-9078

Mitre link : CVE-2026-9078

CVE.ORG link : CVE-2026-9078

JSON object : View

Products Affected

mozilla

firefox

CWE

CWE-451

User Interface (UI) Misrepresentation of Critical Information

{"id": "CVE-2026-9078", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-9078", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-26T20:09:07.824977Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.5, "exploitabilityScore": 2.8}]}, "affected": [{"source": "security@mozilla.org", "affectedData": [{"vendor": "Mozilla", "product": "Firefox for iOS", "versions": [{"status": "unaffected", "version": "151.1", "versionType": "rpm", "lessThanOrEqual": "*"}]}]}], "published": "2026-05-25T15:16:22.970", "references": [{"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2029371", "tags": ["Permissions Required"], "source": "security@mozilla.org"}, {"url": "https://www.mozilla.org/security/advisories/mfsa2026-52/", "tags": ["Vendor Advisory"], "source": "security@mozilla.org"}], "vulnStatus": "Undergoing Analysis", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-451"}]}], "descriptions": [{"lang": "en", "value": "Firefox for iOS displayed specially crafted right-to-left (RTL) and internationalized domain names (IDNs) incorrectly in link preview UI surfaces. A crafted RTL hostname could visually reorder portions of the displayed domain, causing attacker-controlled sites to appear as trusted origins. This vulnerability was fixed in Firefox for iOS 151.1."}, {"lang": "es", "value": "Firefox para iOS mostraba incorrectamente nombres de dominio de derecha a izquierda (RTL) y nombres de dominio internacionalizados (IDN) especialmente manipulados en las superficies de la interfaz de usuario de vista previa de enlaces. Un nombre de host RTL manipulado podr\u00eda reordenar visualmente porciones del dominio mostrado, haciendo que los sitios controlados por el atacante aparecieran como or\u00edgenes de confianza. Esta vulnerabilidad fue corregida en Firefox para iOS 151.1."}], "lastModified": "2026-07-23T11:10:00.120", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:mozilla:firefox:*:*:*:*:*:iphone_os:*:*", "vulnerable": true, "matchCriteriaId": "E326C4E6-FC71-4889-954D-274A02D852F5", "versionEndExcluding": "151.1"}], "operator": "OR"}]}], "sourceIdentifier": "security@mozilla.org"}