CVE-2026-81267: Vulnerability in Mozilla Firefox for iOS

This vulnerability involves a stalled popup navigation in Firefox for iOS that allows an attacker to spoof the address bar origin. Specifically, after the navigation commit, the address bar shows the legitimate destination origin, but the content rendered remains controlled by the attacker. This discrepancy can mislead users about the true origin of the content they are viewing. The flaw is identified as CWE-451 (XML External Entity Injection or similar origin confusion issues). Mozilla fixed this issue in Firefox for iOS version 155.0 as per their security advisory MFSA 2026-81.

The vulnerability allows an attacker to cause the address bar to display a legitimate destination origin while rendering attacker-controlled content. This can lead to address bar origin spoofing, potentially misleading users about the authenticity of the webpage they are viewing. The impact is rated moderate with a CVSS score of 5.4, indicating limited confidentiality impact, no integrity impact, and low availability impact.

Mozilla has fixed this vulnerability in Firefox for iOS version 155.0. Users and administrators should update to Firefox for iOS 155.0 or later to remediate this issue. No additional mitigation steps are indicated by the vendor advisory.