CVE-2026-8706

🔶 medium

Summary

Firefox for iOS hosted Reader mode on an unauthenticated local web server, allowing another application on the same device to request arbitrary URLs and receive the response rendered with the signed-in user's cookies. This vulnerability was fixed in Firefox for iOS 151.0.

CVSS Score

6.5

Medium

EPSS Score

0.2

Exploit Probability

Published Date

2026-05-19

First Seen: 2026-05-20

📊 Relative Risk Intelligence

This CVE is Lower Risk - more severe than 46.6% of all 365,891 vulnerabilities in our database.

#195,497

Below average severity

Severity Percentile

🎯 CISA SSVC Assessment Updated: May 19, 2026

🔍 Exploitation Status

None

No known exploits

⚙️ Automatable

Requires human interaction

💥 Technical Impact

Partial

Limited system impact

🏆 Discovered By

Muneaki Nishimura

SSVC data provided by CISA

Last Modified 2026-07-23

Source NVD 🔗

CVSS Vector 3.1 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CWE IDs (Weakness Types)

CWE-200 CWE-306

📦 Affected Products 1

Vendor	Product	Status	Affected Versions
mozilla	firefox	Affected	< 151.0

🔗 References 2

https://bugzilla.mozilla.org/show_bug.cgi?id=2036618

Permissions Required

https://www.mozilla.org/security/advisories/mfsa2026...

Vendor Advisory

🔗 Related CVEs 6

CVE ID	Severity	CVSS	EPSS	Summary	Published
CVE-2026-100756	⚠️ high	8.1	0.3	Incorrect boundary conditions in the Audio/Video: Playback component. This vulnerability was fixed in Firefox ESR 153.4,...	2026-09-29
CVE-2026-100767	⚠️ high	8.8	0.3	Use-after-free in the Networking: Cache component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, T...	2026-09-29
CVE-2026-100768	⚠️ high	8.8	0.3	Use-after-free in the Graphics: WebGPU component. This vulnerability was fixed in Thunderbird 157 and Firefox 157.	2026-09-29
CVE-2026-100769	⚠️ high	8.8	0.3	Use-after-free in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird ...	2026-09-29
CVE-2026-100770	⛔ critical	9.6	0.3	Sandbox escape due to use-after-free in the DOM: Content Processes component. This vulnerability was fixed in Firefox ES...	2026-09-29
CVE-2026-100771	⚠️ high	8.1	0.3	Undefined behavior in the DOM: Streams component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Th...	2026-09-29

These CVEs affect the same products