CVE-2026-8706

🔶 medium

Summary

Firefox for iOS hosted Reader mode on an unauthenticated local web server, allowing another application on the same device to request arbitrary URLs and receive the response rendered with the signed-in user's cookies. This vulnerability was fixed in Firefox for iOS 151.0.

CVSS Score

6.5

Medium

EPSS Score

0.0

Exploit Probability

Published Date

2026-05-19

First Seen: 2026-05-20

📊 Relative Risk Intelligence

This CVE is Lower Risk - more severe than 47.8% of all 325,680 vulnerabilities in our database.

#169,892

Below average severity

Severity Percentile

🎯 CISA SSVC Assessment Updated: May 19, 2026

🔍 Exploitation Status

None

No known exploits

⚙️ Automatable

Requires human interaction

💥 Technical Impact

Partial

Limited system impact

🏆 Discovered By

Muneaki Nishimura

SSVC data provided by CISA

Last Modified 2026-05-20

Source NVD 🔗

CVSS Vector 3.1 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CWE IDs (Weakness Types)

CWE-200 CWE-306

📦 Affected Products 1

Vendor	Product	Status	Affected Versions
mozilla	firefox	Affected	< 151.0

🔗 References 2

https://bugzilla.mozilla.org/show_bug.cgi?id=2036618

Permissions Required

https://www.mozilla.org/security/advisories/mfsa2026...

Vendor Advisory

🔗 Related CVEs 6

CVE ID	Severity	CVSS	EPSS	Summary	Published
CVE-2026-10701	⚠️ high	7.5	0.0	Incorrect boundary conditions in the Graphics: Text component. This vulnerability was fixed in Firefox 151.0.3.	2026-06-02
CVE-2026-10702	🔶 medium	4.3	0.0	JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 151.0.3.	2026-06-02
CVE-2026-9308	🔶 medium	5.4	0.0	Firefox for iOS Reader View replaced page content in its HTML template before replacing other internal placeholders. A m...	2026-06-01
CVE-2026-9309	🔶 medium	5.4	0.0	Firefox for iOS Reader View did not properly escape HTML tags in JSON-LD metadata. A malicious page could inject markup ...	2026-06-01
CVE-2026-9078	🔶 medium	5.4	0.0	Firefox for iOS displayed specially crafted right-to-left (RTL) and internationalized domain names (IDNs) incorrectly in...	2026-05-25
CVE-2026-8945	⚠️ high	7.5	0.1	Sandbox escape in Firefox and Firefox Focus for Android. This vulnerability was fixed in Firefox 151.	2026-05-19

These CVEs affect the same products