CVE-2026-14906

Published: Jul 13, 2026Modified: Jul 14, 2026

5.3

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Exploitability: 3.9 / Impact: 1.4

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

Pages with malicious titles could potentially allow saved PDF content to overwrite PDF files or bundled content within the Firefox for iOS application sandbox. This vulnerability was fixed in Firefox for iOS 152.4.

Affected (1)

Products: Mozilla: Firefox Mobile

Mozilla

1 product

Firefox Mobile

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Mozilla Firefox Mobile	Before 152.4

Related CWEs

CWE-434

Unrestricted Upload of File with Dangerous Type

The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.

References (2)

https://bugzilla.mozilla.org/show_bug.cgi?id=2045842

Source: security@mozilla.org

Permissions Required

https://www.mozilla.org/security/advisories/mfsa2026-66/

Source: security@mozilla.org

Vendor Advisory

Timeline

No history available yet.