CVE-2026-81267 MEDIUM 5.4
Published: 2026-08-31 20:17:11 UTC · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L
Categories: macOS / Apple
A malicious webpage could stall a popup's cross-origin navigation after commit, causing the address bar to display the destination origin while continuing to render attacker-controlled content. This vulnerability was fixed in Firefox for iOS 155.0.
Weakness: CWE-451
Affected products
cpe:2.3:a:mozilla:firefox_mobile:*:*:*:*:*:iphone_os:*:*