CVE-2026-53900: Firefox for iOS Cookie Injection via Cross-Origin Redirects

Technical summary

The vulnerability resides in Firefox for iOS's handling of TemporaryDocument resources during cross-origin HTTP redirects. When a PDF request originates from a malicious site and is redirected to an unrelated target domain, the browser fails to properly isolate cookies set on the initial request. The cookies persist across the redirect boundary, violating same-origin policy expectations and allowing arbitrary cookie injection into requests bound for the target domain. The issue is rooted in improper state management during the redirect chain (CWE-345: Insufficient Verification of Data Authenticity; CWE-384: Session Fixation). The CVSS 3.1 vector reflects network accessibility, low attack complexity, and no privilege requirement, but limited impact (confidentiality via session compromise, no integrity or availability impact on the browser itself).

Business impact

Organizations relying on Firefox for iOS as a corporate or BYOD browser should be aware that users are exposed to session hijacking and credential interception attacks. If employees access sensitive web applications (banking, email, internal portals) via Firefox for iOS on personal or company devices, attackers could inject malicious cookies to impersonate users or exfiltrate session tokens. The impact is heightened in environments where users frequently visit untrusted websites or click suspicious links. While the CVSS score is moderate, the practical risk depends on the sensitivity of web applications accessed and the trustworthiness of sites users visit.

Affected systems

Firefox for iOS versions prior to 152.0 are vulnerable. Desktop Firefox and other Mozilla products are not affected by this specific vulnerability. The flaw is exclusive to the iOS mobile implementation of the browser. Users on iPad and iPhone running Firefox for iOS should prioritize updating immediately.

Exploitability

Exploitation requires user interaction—the user must visit a malicious website that triggers the redirect chain. No special authentication is required, and network access is trivial. The attack surface is broad: any website willing to serve malicious content can attempt the exploit. However, successful exploitation depends on the target domain accepting and acting on the injected cookies, limiting the scope to sites that do not validate cookie origins. Exploitation is not currently tracked in the KEV catalog, indicating no observed active weaponization in the wild as of publication.

Remediation

Update Firefox for iOS to version 152.0 or later. For iOS users, navigate to the App Store, search for Firefox, and install the latest available version. Verify the version number in Firefox settings (Settings > About Firefox) to confirm the update completed successfully. No configuration changes or workarounds are available; patching is the only mitigation.

Patch guidance

Mozilla released Firefox for iOS 152.0 as the corrected version addressing this vulnerability. Users should enable automatic app updates in iOS settings (Settings > App Store > Automatic Updates) to ensure timely deployment. Security teams managing iOS devices via MDM should verify that device policies enforce the latest Firefox version or remove the browser from unmanaged devices if policy cannot be enforced. Verify patch installation by checking the version string in the Firefox settings menu.

Detection guidance

Detection is challenging from a network perspective because the attack exploits in-browser state management rather than network-level anomalies. Organizations may monitor for unusual cookie values appearing in requests to sensitive applications, or for session tokens originating from unexpected browsers or iOS user agents followed by suspicious activity. Endpoint detection on managed iOS devices should confirm Firefox version compliance. Web application firewalls can flag requests with suspicious or mismatched cookie origins, though false positives may occur. User awareness training on not clicking links from untrusted sources remains the most practical defense.

Why prioritize this

Although the CVSS score is moderate (4.3), this vulnerability merits prompt attention because it directly undermines browser security assumptions around cookie isolation and same-origin policy. The attack requires only user interaction and network access, making it accessible to any attacker. Organizations with a significant iOS user base or those where employees access sensitive applications on personal devices should treat this as a near-term priority. The lack of KEV activity suggests a narrow window before active exploitation becomes widespread, making early patching advisable.

Risk score, explained

The CVSS 3.1 score of 4.3 (MEDIUM) reflects: network-based attack vector (AV:N) with low complexity (AC:L) and no privilege requirement (PR:N), but requiring user interaction (UI:R). Impact is limited to confidentiality (C:L) via cookie theft/session hijacking, with no integrity or availability impact on the user's system (I:N, A:N). The scope is unchanged (S:U), meaning the vulnerability does not affect other applications or users. The moderate score appropriately captures the real-world risk: while easily exploitable, damage is bounded to session compromise rather than system compromise or data loss at scale.

Frequently asked questions