Skip to content
CVE PROGRAM SOURCE RECORD5.5 Medium

CVE-2026-103417

Saved credentials can be autofilled after cross-origin navigation

Description

Firefox for iOS could autofill saved credentials into a new page if cross-origin navigation occurred while the saved-login UI was open. Autofill was not bound to the originating page or rejected when its origin changed. This vulnerability was fixed in Firefox for iOS 157.1.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Mozilla Firefox for iOS

  • 157.1 to ≤ *unaffected

References