Mozilla: >> Firefox Mobile >> 17.1 Security Vulnerabilities
An attacker could have performed HTML template injection via Reader Mode and exfiltrated user information. This vulnerability affects Firefox for iOS < 120.
CVSS Score
6.1
EPSS Score
0.003
Published
2023-11-21
When opening a page in reader mode, the redirect URL could have caused attacker-controlled script to execute in a reflected Cross-Site Scripting (XSS) attack. This vulnerability affects Firefox for iOS < 119.
CVSS Score
6.1
EPSS Score
0.004
Published
2023-10-25
Scanning a QR code that contained a javascript: URL would have resulted in the Javascript being executed.
CVSS Score
6.1
EPSS Score
0.004
Published
2023-02-16
Internal URLs are protected by a secret UUID key, which could have been leaked to web page through the Referrer header. This vulnerability affects Firefox for iOS < 102.
CVSS Score
6.5
EPSS Score
0.004
Published
2022-12-22
By holding a reference to the eval() function from an about:blank window, a malicious webpage could have gained access to the InstallTrigger object which would allow them to prompt the user to install an extension. Combined with user confusion, this could result in an unintended or malicious extension being installed. This vulnerability affects Firefox < 80, Thunderbird < 78.2, Thunderbird < 68.12, Firefox ESR < 68.12, Firefox ESR < 78.2, and Firefox for Android < 80.
CVSS Score
6.5
EPSS Score
0.014
Published
2020-10-01
A rogue webpage could override the injected WKUserScript used by the logins autofill, this exploit could result in leaking a password for the current domain. This vulnerability affects Firefox for iOS < 28.
CVSS Score
6.5
EPSS Score
0.008
Published
2020-08-10
A rogue webpage could override the injected WKUserScript used by the download feature, this exploit could result in the user downloading an unintended file. This vulnerability affects Firefox for iOS < 28.
CVSS Score
6.5
EPSS Score
0.007
Published
2020-08-10
IndexedDB should be cleared when leaving private browsing mode and it is not, the API for WKWebViewConfiguration was being used incorrectly and requires the private instance of this object be deleted when leaving private mode. This vulnerability affects Firefox for iOS < 27.
CVSS Score
6.5
EPSS Score
0.007
Published
2020-07-09
For native-to-JS bridging the app requires a unique token to be passed that ensures non-app code can't call the bridging functions. That token could leak when used for downloading files. This vulnerability affects Firefox for iOS < 26.
CVSS Score
4.3
EPSS Score
0.008
Published
2020-07-09
For native-to-JS bridging, the app requires a unique token to be passed that ensures non-app code can't call the bridging functions. That token was being used for JS-to-native also, but it isn't needed in this case, and its usage was also leaking this token. This vulnerability affects Firefox for iOS < 25.
CVSS Score
7.5
EPSS Score
0.009
Published
2020-05-26