Firefox for iOS directly interpolated the page’s HTML language attribute into translation JavaScript, allowing attacker-controlled markup to execute code in Firefox’s privileged content world and bypass the page’s Content Security Policy. This vulnerability was fixed in Firefox for iOS 157.1.
CVE-2026-103418
NONE
Updated Oct 13, 2026
Firefox
CVE Details
CVE ID
CVE-2026-103418
Published Date
Oct 13, 2026
Vendor
Firefox
Severity
NONE
Impact
Minimal impact
Source
View Advisory