CVE-2026-103417 PUBLISHED

Saved credentials can be autofilled after cross-origin navigation

Assigner: mozilla
Reserved: 30.09.2026 Published: 13.10.2026 Updated: 13.10.2026

Firefox for iOS could autofill saved credentials into a new page if cross-origin navigation occurred while the saved-login UI was open. Autofill was not bound to the originating page or rejected when its origin changed. This vulnerability was fixed in Firefox for iOS 157.1.

Product Status

Vendor Mozilla
Product Firefox for iOS
Versions
  • unaffected from 157.1 to * (incl.)

Credits

  • planctonone

References