Mozilla Firefox For Ios vulnerabilities
28 vulnerabilities
Known vulnerabilities in Mozilla Firefox For Ios, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.
CVE-2021-29958mozillafirefox+1
EPSS score0.67%
When a download was initiated, the client did not check whether it was in normal or private browsing mode, which led to private mode cookies being shared in normal browsing mode. This vulnerability affects Firefox for iOS < 34.CVE-2020-15662mozillafirefox for ios+1EPSS score0.68%
A rogue webpage could override the injected WKUserScript used by the download feature, this exploit could result in the user downloading an unintended file. This vulnerability affects Firefox for iOS < 28.CVE-2020-15661mozillafirefox for ios+1EPSS score0.85%
A rogue webpage could override the injected WKUserScript used by the logins autofill, this exploit could result in leaking a password for the current domain. This vulnerability affects Firefox for iOS < 28.CVE-2020-15651mozillafirefox+1EPSS score0.58%
A unicode RTL order character in the downloaded file name can be used to change the file's name during the download UI flow to change the file extension. This vulnerability affects Firefox for iOS < 28.CVE-2020-6830mozillafirefox for ios+1EPSS score0.91%
For native-to-JS bridging, the app requires a unique token to be passed that ensures non-app code can't call the bridging functions. That token was being used for JS-to-native also, but it isn't needed in this case, and its usage was also leaking this token. This vulnerability affects Firefox for iOS < 25.CVE-2020-12414mozillafirefox for ios+1EPSS score0.68%
IndexedDB should be cleared when leaving private browsing mode and it is not, the API for WKWebViewConfiguration was being used incorrectly and requires the private instance of this object be deleted when leaving private mode. This vulnerability affects Firefox for iOS < 27.CVE-2020-12404mozillafirefox for ios+1EPSS score0.79%
For native-to-JS bridging the app requires a unique token to be passed that ensures non-app code can't call the bridging functions. That token could leak when used for downloading files. This vulnerability affects Firefox for iOS < 26.CVE-2022-1887mozillafirefox+1EPSS score0.60%
The search term could have been specified externally to trigger SQL injection. This vulnerability affects Firefox for iOS < 101.CVE-2022-31746mozillafirefox for ios+1EPSS score0.43%
Internal URLs are protected by a secret UUID key, which could have been leaked to web page through the Referrer header. This vulnerability affects Firefox for iOS < 102.CVE-2024-26283chainguardfirefox-esr+2EPSS score0.28%
An attacker could have executed unauthorized scripts on top origin sites using a JavaScript URI when opening an external URL with a custom Firefox scheme. This vulnerability affects Firefox for iOS < 123.CVE-2024-26281chainguardfirefox-esr+2EPSS score0.31%
Upon scanning a JavaScript URI with the QR code scanner, an attacker could have executed unauthorized scripts on the current top origin sites in the URL bar. This vulnerability affects Firefox for iOS < 123.CVE-2024-26282chainguardfirefox-esr+2EPSS score0.34%
Using an AMP url with a canonical element, an attacker could have executed JavaScript from an opened bookmarked page. This vulnerability affects Firefox for iOS < 123.CVE-2024-0953chainguardfirefox+4EPSS score0.31%
When a user scans a QR Code with the QR Code Scanner feature, the user is not prompted before being navigated to the page specified in the code. This may surprise the user and potentially direct them to unwanted content. This vulnerability affects Firefox for iOS < 129.CVE-2024-31392chainguardfirefox-esr+2EPSS score0.38%
If an insecure element was added to a page after a delay, Firefox would not replace the secure icon with a mixed content security status This vulnerability affects Firefox for iOS < 124.CVE-2024-31393chainguardfirefox-esr+2EPSS score0.33%
Dragging Javascript URLs to the address bar could cause them to be loaded, bypassing restrictions and security protections This vulnerability affects Firefox for iOS < 124.CVE-2024-43111chainguardfirefox+10EPSS score0.27%
Long pressing on a download link could potentially allow Javascript commands to be executed within the browser This vulnerability affects Firefox for iOS < 129.CVE-2024-43113chainguardfirefox+10EPSS score0.25%
The contextual menu for links could provide an opportunity for cross-site scripting attacks This vulnerability affects Firefox for iOS < 129.CVE-2024-43112chainguardfirefox+10EPSS score0.25%
Long pressing on a download link could potentially provide a means for cross-site scripting This vulnerability affects Firefox for iOS < 129.CVE-2024-53975chainguardfirefox+4EPSS score0.29%
Accessing a non-secure HTTP site that uses a non-existent port may cause the SSL padlock icon in the location URL bar to, misleadingly, appear secure. This vulnerability affects Firefox for iOS < 133.CVE-2024-53976chainguardfirefox+4EPSS score0.30%
Under certain circumstances, navigating to a webpage would result in the address missing from the location URL bar, making it unclear what the URL was for the loaded webpage. This vulnerability affects Firefox for iOS < 133.