CVE-2026-9309

{"id": "CVE-2026-9309", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-9309", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-01T13:51:24.582302Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.5, "exploitabilityScore": 2.8}]}, "affected": [{"source": "security@mozilla.org", "affectedData": [{"vendor": "Mozilla", "product": "Firefox for iOS", "versions": [{"status": "unaffected", "version": "151.2", "versionType": "rpm", "lessThanOrEqual": "*"}]}]}], "published": "2026-06-01T13:16:33.623", "references": [{"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2036573", "tags": ["Permissions Required"], "source": "security@mozilla.org"}, {"url": "https://www.mozilla.org/security/advisories/mfsa2026-53/", "tags": ["Vendor Advisory"], "source": "security@mozilla.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "Firefox for iOS Reader View did not properly escape HTML tags in JSON-LD metadata. A malicious page could inject markup that changed Reader View behavior and leaked sensitive URL parameters. These parameters could then be used to access internal pages, potentially resulting in arbitrary JavaScript execution in an internal origin. This vulnerability was fixed in Firefox for iOS 151.2."}, {"lang": "es", "value": "Firefox para iOS Vista de lectura no escapaba correctamente las etiquetas HTML en los metadatos JSON-LD. Una p\u00e1gina maliciosa podr\u00eda inyectar marcado que cambiaba el comportamiento de la Vista de lectura y filtraba par\u00e1metros URL sensibles. Estos par\u00e1metros podr\u00edan entonces ser utilizados para acceder a p\u00e1ginas internas, lo que podr\u00eda resultar en ejecuci\u00f3n arbitraria de JavaScript en un origen interno. Esta vulnerabilidad fue corregida en Firefox para iOS 151.2."}], "lastModified": "2026-07-22T07:10:00.107", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:mozilla:firefox:*:*:*:*:*:iphone_os:*:*", "vulnerable": true, "matchCriteriaId": "B45EA8E8-B058-45B8-B0AB-77F61594BC17", "versionEndExcluding": "151.2"}], "operator": "OR"}]}], "sourceIdentifier": "security@mozilla.org"}