CVE-2026-8706
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk9th percentile - higher than 9% of all known CVEs
Summary
Firefox for iOS hosted Reader mode on an unauthenticated local web server, allowing another app on the same device to request arbitrary URLs and receive responses with the signed-in user's cookies. Fixed in Firefox for iOS 151.0.
Risk Assessment
A malicious app on the device can intercept user session cookies, leading to identity theft and unauthorized account access.
Recommendation
Update Firefox for iOS to version 151.0 or later and avoid using Reader mode on untrusted sites.
Original NVD description (English source)
Firefox for iOS hosted Reader mode on an unauthenticated local web server, allowing another application on the same device to request arbitrary URLs and receive the response rendered with the signed-in user's cookies. This vulnerability was fixed in Firefox for iOS 151.0.