Firefox for iOS versions prior to 152.0 used partial domain matching when attaching cookies to PDF requests, which allowed a malicious site on a suffix domain to receive cookies intended for the target site. This cross-origin cookie leakage vulnerability (CWE-345) was reported by Muneaki Nishimura and fixed in Firefox for iOS 152.0. The vulnerability has a CVSS 3.1 base score of 6.5 with vector AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N, indicating network attack vector, low attack complexity, no privileges or user interaction required, unchanged scope, and impacts confidentiality and integrity. The vendor advisory confirms the fix and provides additional context on related cookie injection issues addressed in the same release.

The vulnerability allows an attacker controlling a malicious suffix domain to receive cookies belonging to a legitimate target site when a PDF link is opened, leading to potential unauthorized disclosure of sensitive cookie data. This can compromise user privacy and session integrity by leaking authentication or tracking cookies. The impact affects confidentiality and integrity but does not affect availability. There are no known exploits in the wild at the time of publication.

This vulnerability is fixed in Firefox for iOS version 152.0. Users and administrators should update to Firefox for iOS 152.0 or later to remediate this issue. No additional mitigation steps are required beyond applying the official update from Mozilla.