Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Firefox for iOS Reader View did not properly escape HTML tags in JSON-LD metadata. A malicious page could inject markup that changed Reader View behavior and leaked sensitive URL parameters. These parameters could then be used to access internal pages, potentially resulting in arbitrary JavaScript execution in an internal origin. This vulnerability was fixed in Firefox for iOS 151.2.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
🟠 #Firefox for #iOS, Cross‑Site Scripting (XSS), #CVE‑2026‑9309 (Medium) -DC-Jun2026-172 https://dailycve.com/firefox-for-ios-cross-site-scripting-xss-cve-2026-9309-medium-dc-jun2026-172/
Post summary
The tweet announces a medium‑severity XSS vulnerability (CVE‑2026‑9309) in Firefox for iOS, providing the CVE ID and a link to DailyCVE for details, but no exploitation or patch information.
CVE-2026-9309 HTML Injection in Firefox for iOS Reader View JSON-LD Metadata Before 151... https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-9309 Vulnerability Notification: https://alerts.vulmon.com/?utm_source=twitter&utm_medium=social&utm_campaign=2102281&utm_content=3
Post summary
The text announces a new HTML injection vulnerability (CVE-2026-9309) in Firefox for iOS Reader View prior to version 151, providing links for further details.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | mozilla | firefox | - | iphone_os | - |