CVE-2026-9309: Firefox for iOS Reader View HTML Injection & Parameter Leakage

Technical summary

CVE-2026-9309 is a cross-site scripting (CWE-79) vulnerability in Firefox for iOS Reader View stemming from inadequate HTML escaping of JSON-LD metadata. Reader View processes structured data markup from web pages to extract and display article content in a simplified, ad-free format. When parsing JSON-LD metadata, the application failed to escape HTML entities, allowing an attacker to break out of the data context and inject arbitrary markup. This injected markup could manipulate Reader View's rendering behavior and, more critically, cause the leak of URL parameters present in the page's context. Because Reader View operates with elevated privileges relative to standard web content, parameters exposed through this mechanism could be directed to internal endpoints that would normally be inaccessible, opening a pathway to arbitrary script execution within an internal origin context.

Business impact

The vulnerability poses a moderate but meaningful risk to iOS users who regularly rely on Reader View for safe, distraction-free reading. An attacker could harvest sensitive data embedded in URLs—including session tokens, CSRF tokens, or tracking identifiers—without the user's explicit awareness. If those parameters are subsequently used to access internal endpoints, the compromise could extend beyond data theft to active code execution, potentially compromising user accounts or device security. For enterprises managing iOS devices through Mobile Device Management (MDM), this could serve as a foothold for lateral movement or privilege escalation, especially if users are authenticated to internal web applications.

Affected systems

Firefox for iOS versions prior to 151.2 are affected. The vulnerability does not impact Firefox on desktop or other mobile browsers. Users running version 151.2 or later are protected. Organizations should verify the Firefox for iOS version in use across their managed device fleet and ensure automatic updates are enabled.

Exploitability

The vulnerability requires user interaction—a victim must visit a malicious website where Reader View is activated (either manually or through automatic triggering). No authentication or special browser configuration is required. The attack surface is broad because Reader View is a standard feature available to all users, and activation is straightforward. However, the attacker must craft a specific payload targeting JSON-LD metadata, which requires moderate technical sophistication. The CVSS score of 5.4 (MEDIUM) reflects the requirement for user interaction and the absence of system-wide availability impact, though the potential for parameter leakage and internal endpoint access elevates the severity beyond a typical reflected XSS.

Remediation

Update Firefox for iOS to version 151.2 or later. This patch properly escapes HTML tags within JSON-LD metadata processing, preventing the injection and execution of attacker-controlled markup. Users should enable automatic app updates in the iOS App Store settings to receive security patches as soon as they are released. No configuration changes or workarounds are available; patching is the only mitigation.

Patch guidance

Install Firefox for iOS version 151.2 or later. Steps: 1) Open the iOS App Store. 2) Tap your profile icon (top-right). 3) Scroll to Firefox and check for an 'Update' button; if present, tap it. 4) Alternatively, enable 'Automatic Updates' in App Store settings (Settings > [Your Name] > App Store > App Updates) to receive patches automatically. 5) Verify the update completed by checking Settings > Firefox > Version (or equivalent within the app). If your organization manages iOS devices via MDM, deploy the updated version through your MDM platform or ensure that automatic updates are enforced for managed devices.

Detection guidance

Detection of exploitation after the fact is difficult without access to device logs. Organizations can monitor for: 1) Unusual access patterns to internal endpoints from iOS clients, particularly with unexpected URL parameters. 2) Web server logs showing requests from Firefox for iOS that include sensitive parameters being leaked to attacker-controlled domains. 3) User reports of Reader View behaving unexpectedly (e.g., garbled display, unexpected redirects). Proactive detection during the attack is limited; the most effective approach is ensuring timely deployment of version 151.2 to prevent exploitation.

Why prioritize this

While the CVSS score is moderate (5.4), the vulnerability merits priority patching due to the potential for parameter leakage and internal endpoint access, which could escalate to arbitrary code execution. The attack requires only user interaction—a low barrier—and Reader View is a widely-used feature. Organizations with BYOD policies or those managing iOS devices running older versions should prioritize this patch to close a pathway to credential theft and internal system compromise.

Risk score, explained

The CVSS v3.1 score of 5.4 reflects: Attack Vector (Network) indicating remote exploitability; Access Complexity (Low) meaning no special conditions are required; Privilege Required (None) as any unauthenticated user can exploit it; User Interaction (Required) since the victim must activate Reader View; Scope (Unchanged) as the impact is limited to the vulnerable component; Confidentiality (Low) due to parameter leakage; and Integrity (Low) reflecting the ability to inject and manipulate content. Availability is not impacted. The score appropriately captures a moderate-severity issue that requires user action but has potential for privilege escalation through internal endpoint access.

Frequently asked questions