Medium · 5.4 CVE-2026-9308 EUVD-2026-33629GHSA-h55j-6jm9-f8vp

Arbitrary JavaScript execution in Reader View due to wrong HTML replacement order

Published Jun 1, 2026 · Updated Jun 1, 2026 · Assigned by mozilla

Vendor: Mozilla Product: Firefox for iOS Platform: iOS Category: Browsers

Description

Firefox for iOS Reader View replaced page content in its HTML template before replacing other internal placeholders. A malicious page could include a placeholder string that was later substituted with JSON-LD data, potentially resulting in arbitrary JavaScript execution. This vulnerability was fixed in Firefox for iOS 151.2.

Affected products

Vendor	Product	Affected	Fixed
Mozilla	Firefox for iOS	—	151.2

Advisories 1

WID-SEC-2026-1763 Mozilla Firefox für iOS: Mehrere Schwachstellen ermöglichen Ausführen von beliebigem Programmcode BSI CERT-Bund (WID) · Jun 1, 2026

References

https://bugzilla.mozilla.org/show_bug.cgi?id=2039422
https://www.mozilla.org/security/advisories/mfsa2026-53/