CVE-2026-86853CWE-451

CVE-2026-86853

Medium · published September 8, 2026

CVSS v3.1
4.3
EPSS
0%
Percentile
19.2
In the wild
Unconfirmed
What it is

A malicious webpage could repeatedly trigger external URL schemes, causing system prompts or external application launches. This could make Firefox for iOS temporarily unusable until the page is closed. This vulnerability was fixed in Firefox for iOS 155.1.

The record
Technical detail
CVSS v3.1
4.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
CVSS v4.0
Not supplied
EPSS
0.00278 · 19.2th percentile
Weakness
CWE-451 · User Interface (UI) Misrepresentation of Critical Information
Published
2026-09-08T20:18Z
Affected products (1)
ProductVersionsFixed in
mozilla/firefox_mobile< 155.1155.1
References (2)
https://bugzilla.mozilla.org/show_bug.cgi?id=1847631 · [email protected]https://www.mozilla.org/security/advisories/mfsa2026-89/ · [email protected]
EPSS history
Timeline
  • 10 SEP 03:18Z
    EPSS moved — → 0%
    epss
  • 08 SEP 15:14Z
    Repeated external URL scheme launches could potentially cause a denial of service in Firefox for iOS
    cvelistv5