Vulnerability · Published May 19, 2026 · Assigned by mozilla
CVE-2026-8706Sensitive user data could be leaked to other applications through Reader mode
Medium 6.5
In plain English
A medium-severity missing authentication in Firefox for iOS from Mozilla. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 9% of all known vulnerabilities).
Severity (CVSS 3.1)6.5Medium
Exploit odds (30 days)0.2%top 91.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Firefox for iOS hosted Reader mode on an unauthenticated local web server, allowing another application on the same device to request arbitrary URLs and receive the response rendered with the signed-in user's cookies. This vulnerability was fixed in Firefox for iOS 151.0.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu:22.04:LTS | mozjs102 | no fix listed | UBUNTU-CVE-2026-8706 |
| Ubuntu:24.04:LTS | mozjs102 | no fix listed | UBUNTU-CVE-2026-8706 |
| Ubuntu:24.04:LTS | mozjs115 | no fix listed | UBUNTU-CVE-2026-8706 |
| Ubuntu:22.04:LTS | mozjs78 | no fix listed | UBUNTU-CVE-2026-8706 |
| Ubuntu:22.04:LTS | mozjs91 | no fix listed | UBUNTU-CVE-2026-8706 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Mozilla | Firefox for iOS | see references |
Weakness: CWE-306, CWE-200 · Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N