CVE-2026-9078

Firefox iOS RTL Domain Rendering Issue in Link Preview

CVSS 5.4 MEDIUMEPSS 0.2%CWE-451

Firefox for iOS displayed specially crafted right-to-left (RTL) and internationalized domain names (IDNs) incorrectly in link preview UI surfaces. A crafted RTL hostname could visually reorder portions of the displayed domain, causing attacker-controlled sites to appear as trusted origins. This vulnerability was fixed in Firefox for iOS 151.1.

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L

Produtos afetados

Mozilla · Firefox for iOS

Quer saber se a sua infraestrutura está exposta a isto?

Falar com a TrueHacking →

Referências

https://bugzilla.mozilla.org/show_bug.cgi?id=2029371 https://www.mozilla.org/security/advisories/mfsa2026-52/