High · 8.8 CVE-2026-103418 EUVD-2026-98339GHSA-7fw9-g4rg-xvqv

Universal XSS via the HTML language attribute in Translation Services

Published Oct 13, 2026 · Updated Oct 14, 2026 · Assigned by mozilla

Vendor: Mozilla Product: Firefox for iOS Platform: iOS Category: Browsers

Description

Firefox for iOS directly interpolated the page’s HTML language attribute into translation JavaScript, allowing attacker-controlled markup to execute code in Firefox’s privileged content world and bypass the page’s Content Security Policy. This vulnerability was fixed in Firefox for iOS 157.1.

Affected products

Vendor	Product	Affected	Fixed
Mozilla	Firefox for iOS	—	157.1

Advisories 1

WID-SEC-2026-3879 Mozilla Firefox iOS: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 12, 2026

References

https://bugzilla.mozilla.org/show_bug.cgi?id=2062109
https://www.mozilla.org/security/advisories/mfsa2026-105/