CVE-2026-8706

6.5 mediumEPSS 0.2%

Medium (6.5) in mozilla firefox. EPSS 0.2% chance of exploitation in the next 30 days.

Firefox for iOS hosted Reader mode on an unauthenticated local web server, allowing another application on the same device to request arbitrary URLs and receive the response rendered with the signed-in user's cookies. This vulnerability was fixed in Firefox for iOS 151.0.

Severity

CVSS 3.1

6.5 medium

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS: 0.2% chance of exploitation in the next 30 days; higher than 8% of CVEs (scores of 2026-10-31)
CWEs: CWE-200, CWE-306
Published: 2026-05-19
Modified: 2026-07-23
Record from: the NVD, synced 2026-10-19

Affected

mozilla:firefox

References

https://bugzilla.mozilla.org/show_bug.cgi?id=2036618
https://www.mozilla.org/security/advisories/mfsa2026-49/

Check your stack JSON