Mozilla Firefox Mobile CVEs.
Published CVEs affecting Mozilla Firefox Mobile, ranked by exploit odds.
-
CVE-2026-84135
Other issue in Firefox Focus for Android. This vulnerability was fixed in Firefox 155.
-
CVE-2026-16373
Information disclosure in the Privacy component in Firefox for Android. This vulnerability was fixed in Firefox 153.
-
CVE-2026-84117
Privilege escalation in Firefox for Android. This vulnerability was fixed in Firefox 155.
-
CVE-2026-92033
Privilege escalation in Firefox for Android. This vulnerability was fixed in Firefox 156.
-
CVE-2026-14906
Pages with malicious titles could potentially allow saved PDF content to overwrite PDF files or bundled content within the Firefox for iOS application sandbox. This vulnerability was fixed in Firefox for iOS 152.4.
-
CVE-2026-86853
A malicious webpage could repeatedly trigger external URL schemes, causing system prompts or external application launches. This could make Firefox for iOS temporarily unusable until the page is closed. This vulnerability was fixed in Firefox for iOS 155.1.
-
CVE-2026-74951
Clickjacking issue in Firefox for Android. This vulnerability was fixed in Firefox 154.
-
CVE-2026-74980
Clickjacking issue in the Downloads component in Firefox for Android. This vulnerability was fixed in Firefox 154.
-
CVE-2026-16404
Spoofing issue in Firefox for Android. This vulnerability was fixed in Firefox 153.
-
CVE-2026-84127
Information disclosure in the WebExtensions component in Firefox for Android. This vulnerability was fixed in Firefox 155.
-
CVE-2026-81267
A malicious webpage could stall a popup's cross-origin navigation after commit, causing the address bar to display the destination origin while continuing to render attacker-controlled content. This vulnerability was fixed in Firefox for iOS 155.0.
-
CVE-2026-74975
Spoofing issue in the Downloads component in Firefox for Android. This vulnerability was fixed in Firefox 154.
-
CVE-2026-100823
Spoofing issue in the Downloads component in Firefox for Android. This vulnerability was fixed in Firefox 157.
-
CVE-2026-53900
Firefox for iOS preserved cookies set on the initial PDF request across cross-origin HTTP redirects in TemporaryDocument, allowing a malicious site to inject arbitrary cookies into requests to an unrelated target domain. This vulnerability was fixed in Firefox for iOS 152.0.
-
CVE-2026-53899
Firefox for iOS used partial domain matching when attaching cookies to PDF requests, allowing a malicious site on a suffix domain to receive cookies belonging to the target site. This vulnerability was fixed in Firefox for iOS 152.0.
All CVEs affecting Mozilla Firefox Mobile that appear in CVE.org and NVD, sorted by how likely they are to be exploited (EPSS), with fix status and timeline.