CVE-2026-103418 PUBLISHED

Universal XSS via the HTML language attribute in Translation Services

Assigner: mozilla
Reserved: 30.09.2026 Published: 13.10.2026 Updated: 13.10.2026

Firefox for iOS directly interpolated the page’s HTML language attribute into translation JavaScript, allowing attacker-controlled markup to execute code in Firefox’s privileged content world and bypass the page’s Content Security Policy. This vulnerability was fixed in Firefox for iOS 157.1.

Product Status

Vendor Mozilla
Product Firefox for iOS
Versions
  • unaffected from 157.1 to * (incl.)

Credits

  • Muneaki Nishimura

References