CVE-2026-9308: Firefox for iOS Reader View Template Injection (XSS)

Technical summary

CVE-2026-9308 is a cross-site scripting (CWE-79) vulnerability in Firefox for iOS Reader View stemming from unsafe template processing. The vulnerability arises because HTML content from the web page is inserted into the Reader View template before internal placeholders (specifically those intended for JSON-LD structured data) are replaced. By injecting a string that mimics or completes a placeholder pattern, an attacker can poison the final HTML output so that JSON-LD substitution results in arbitrary JavaScript within the document context. The CVSS 3.1 score of 5.4 (MEDIUM) reflects network accessibility, low attack complexity, no special privileges required, but mandatory user interaction and limited impact scope (same-origin).

Business impact

Reader View is a commonly-used accessibility feature in Firefox for iOS that allows users to focus on article content without ads and formatting distractions. Exploitation of this vulnerability could enable credential theft, session hijacking, or malware distribution through booby-trapped articles or news sites. The attack surface includes any malicious or compromised website. However, the requirement for explicit user action to enable Reader View on a specific page limits mass exploitation. Organizations that allow iOS devices to access internal or partner content should consider the risk if those sites could be compromised or if users may visit untrusted sites.

Affected systems

This vulnerability affects Mozilla Firefox for iOS versions prior to 151.2. Firefox for iOS is available on Apple's App Store and is the primary Firefox offering for iPad and iPhone users. Desktop Firefox (Windows, macOS, Linux) and other Mozilla products are not affected. The vulnerability is specific to the iOS platform's implementation of Reader View.

Exploitability

Exploitation requires a user to visit a malicious or compromised webpage using Firefox for iOS and then manually activate Reader View on that page. No authentication, special network position, or browser configuration is needed from the attacker's perspective, but user action is mandatory. The vulnerability does not appear to be in active exploitation (it is not listed on the CISA Known Exploited Vulnerabilities catalog), and no public exploit code is known. The attack is reliable if a user can be socially engineered to open a suspicious link and enable Reader View.

Remediation

Update Firefox for iOS to version 151.2 or later. Users should enable automatic app updates through the App Store to receive patches promptly. There is no known workaround for users unable to update immediately, though disabling or avoiding Reader View on untrusted websites reduces exposure. Organizations managing iOS devices should push this update through their mobile device management (MDM) solution if deployed.

Patch guidance

Firefox for iOS 151.2 is the fixed version addressing this vulnerability. Users can verify their current version in Settings > Firefox > About Firefox within the app. The patch is available through the Apple App Store; users should check for updates or enable automatic updates. No manual configuration changes are required post-patch. Verify that all deployed instances have been updated to 151.2 or later by checking device inventory and app version reporting through MDM consoles if applicable.

Detection guidance

Monitor for Reader View activation followed by unusual JavaScript execution on iOS Firefox instances, though such logging may not be enabled by default in most environments. From a network perspective, detection is difficult because the payload is generated client-side after page fetch. Security teams should educate users to be cautious when enabling Reader View on unfamiliar or untrusted sites. Organizations using threat intelligence feeds should monitor for reports of compromised news sites or malicious articles promoting Firefox for iOS Reader View usage. Endpoint detection and response (EDR) solutions on iOS may flag suspicious script execution, depending on visibility into WebKit process activity.

Why prioritize this

This vulnerability merits timely but not emergency patching. The MEDIUM severity score and requirement for user interaction keep it below critical or high-risk categories, but the infection vector (web-based, no special privileges) and the prevalence of Firefox for iOS make it a legitimate business risk. Prioritize this update after critical/high vulnerabilities but within a standard 30-day patch cycle. Organizations with strict mobile security policies or users frequently accessing sensitive sites should accelerate deployment.

Risk score, explained

The CVSS 3.1 score of 5.4 reflects: (1) network-based attack vector requiring only a URL; (2) low attack complexity, as the exploit does not require race conditions or specific server configurations; (3) no privileges required; (4) user interaction mandatory (opening Reader View); (5) unchanged scope (confined to the app's sandbox); (6) low confidentiality and integrity impact (session hijacking, credential theft possible but limited by same-origin policy and app sandbox). The absence of availability impact and the user-interaction requirement prevent a higher score despite the logical severity of XSS vulnerabilities.

Frequently asked questions