CVE-2026-9078

Firefox iOS RTL Domain Rendering Issue in Link Preview

Medium · published May 25, 2026

CVSS v3.1
5.4
EPSS
0%
Percentile
16.5
In the wild
Unconfirmed
What it is

Firefox for iOS displayed specially crafted right-to-left (RTL) and internationalized domain names (IDNs) incorrectly in link preview UI surfaces. A crafted RTL hostname could visually reorder portions of the displayed domain, causing attacker-controlled sites to appear as trusted origins. This vulnerability was fixed in Firefox for iOS 151.1.

The record
Technical detail
CVSS v3.1
5.4 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L
CVSS v4.0
Not supplied
EPSS
0.00257 · 16.5th percentile
Published
2026-05-25T14:05Z
EPSS history
Timeline
  • 25 MAY 14:05Z
    Firefox iOS RTL Domain Rendering Issue in Link Preview
    cvelistv5