CVE-2026-53899 Firefox iOS Cookie Theft Vulnerability: Fix & Detection

Technical summary

CVE-2026-53899 is a cookie disclosure vulnerability in Firefox for iOS caused by insufficient domain matching logic during PDF request processing. The browser failed to enforce strict domain boundaries when deciding which cookies to attach to outgoing requests, instead relying on partial suffix matching. This allowed a malicious website on a subdomain or related domain to receive authentication cookies and session tokens belonging to a parent or target domain. The vulnerability is classified as CWE-345 (Insufficient Verification of Data Authenticity) and carries a CVSS 3.1 score of 6.5 (Medium severity). The attack vector is network-based with low complexity, requires no user privileges, and delivers confidentiality and integrity impact without affecting availability.

Business impact

For enterprises, this vulnerability poses a session hijacking and credential theft risk for any user accessing sensitive web applications via Firefox on iOS. If employees use Firefox iOS to authenticate to internal portals, intranet sites, or cloud services (Salesforce, Microsoft 365, GitHub, etc.), an attacker could craft a malicious site to harvest those authentication cookies. The impact extends to both data confidentiality (unauthorized access to user sessions) and integrity (potential for account manipulation if the attacker uses stolen cookies). Organizations with BYOD policies or employees using personal iOS devices should assess exposure. The vulnerability does not enable remote code execution or denial of service, limiting severity, but session theft can cascade into lateral movement and data exfiltration.

Affected systems

Firefox for iOS versions below 152.0 are affected. This includes all iOS devices running any release of Firefox Mobile prior to version 152.0. The vulnerability does not affect Firefox on desktop, Firefox on Android, or other Gecko-based browsers. Organizations should verify which iOS devices in their environment have Firefox installed and identify their current version. Users on older iOS versions who cannot upgrade Firefox to 152.0 or later remain at risk.

Exploitability

The vulnerability requires low technical skill to exploit. An attacker must host a malicious website and trick a user into visiting it while the user has an active session on a target domain. No special network position, authentication, or user interaction beyond visiting the site is required. The attack is passive from the browser's perspective—the malicious site simply needs to make PDF requests to intercept the unintentionally attached cookies. However, practical exploitation is constrained by the attacker's knowledge of which domains the user is logged into, and the effectiveness depends on cookie configuration (HttpOnly flags, SameSite attributes, and session duration). The vulnerability is not listed in CISA's Known Exploited Vulnerabilities (KEV) catalog, suggesting active exploitation in the wild has not been widely documented as of the vulnerability's public disclosure.

Remediation

Organizations should prioritize upgrading Firefox for iOS to version 152.0 or later across all affected iOS devices. For managed environments, deploy mobile device management (MDM) policies to enforce automatic updates or restrict Firefox usage on unpatched devices. For unmanaged (BYOD) scenarios, communicate the patch availability to users and encourage immediate upgrade. As a temporary mitigation (not a substitute for patching), recommend that users avoid visiting untrusted websites while logged into sensitive services via Firefox on iOS, and consider using Safari or other browsers for critical authentication until patches are applied. Additionally, review server-side cookie configuration: ensure authentication cookies use the Secure flag, HttpOnly flag, and strict SameSite=Strict or SameSite=Lax policies to reduce exposure if a similar client-side flaw is exploited.

Patch guidance

Update Firefox for iOS to version 152.0 or later. Users can manually update via the Apple App Store by opening the App Store app, navigating to their profile, scrolling to Firefox, and tapping 'Update'. Alternatively, enable automatic app updates in iOS Settings > App Store > App Updates > Automatic Updates. Organizations managing iOS devices via MDM can push the updated Firefox version directly or configure policies to enforce updates. Verify successful patching by opening Firefox, accessing Settings > About Firefox, and confirming the version number matches 152.0 or higher. No configuration changes are required post-patch; the fix is transparent to the user.

Detection guidance

Detection of exploitation is challenging because the attack is client-side and leaves no clear server-side trace of malicious intent (cookies are legitimately attached). However, organizations can implement the following measures: (1) Monitor for unusual access patterns to sensitive web applications from iOS user agents, especially if access correlates with users visiting unfamiliar or untrusted sites. (2) Review access logs for sessions that span multiple unrelated domains in short timeframes, which may indicate cross-domain cookie reuse. (3) Implement endpoint detection and response (EDR) tools on iOS devices that can flag suspicious browser activity or unauthorized cookie access. (4) Use web application firewalls to detect anomalous authentication cookies or sessions, such as cookies with mismatched domain attributes. (5) Encourage users to report unusual account activity or unexpected session timeouts, which may indicate unauthorized cookie use. Organizations without iOS visibility should consider enforcing browser policies that restrict Firefox to fully patched versions.

Why prioritize this

This vulnerability merits prompt but not emergency remediation. The CVSS score of 6.5 (Medium) reflects the combination of network accessibility and ease of exploitation balanced against the limited impact scope (confidentiality and integrity, not availability). The lack of KEV listing suggests this is not yet a targeted campaign, but the low barrier to exploitation means it could be leveraged opportunistically. Prioritization should be based on organizational risk: enterprises with high-value users on iOS, significant BYOD adoption, or reliance on Firefox for authentication to sensitive services should patch within days. Lower-risk organizations can include this in standard monthly patch cycles but should not delay significantly.

Risk score, explained

The CVSS 3.1 score of 6.5 reflects a Medium severity rating. The attack vector is Network (AV:N), indicating no special network access required. Attack Complexity is Low (AC:L), as the attack requires only a malicious website and user visit. Privileges Required (PR:N) and User Interaction (UI:N) are both 'None', meaning the vulnerability is triggered automatically upon visiting a malicious site. Scope is Unchanged (S:U), so impact is limited to the user's own browser and sessions. Confidentiality impact (C:L) and Integrity impact (I:L) are both Low due to cookie theft enabling unauthorized access and potential session manipulation, while Availability (A:N) is unaffected. This score appropriately prioritizes the vulnerability as a credential/session theft risk without overstating it as critical.

Frequently asked questions