PT-2026-49701

CVE-2026-53900

Published

2026-06-16

Updated

2026-06-17

Description by

CVSS 3.1

4.3

Medium

MetricsAV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Firefox for iOS versions prior to 152.0

Description Firefox for iOS preserved cookies set on the initial PDF request across cross-origin HTTP redirects in TemporaryDocument. This behavior allows a malicious site to inject arbitrary cookies into requests directed to an unrelated target domain.

Recommendations Update to version 152.0.

Exploitability

Exploit

Fix

Impacts

Researchers

Muneaki Nishimura

Vendors

Affected products

Weakness enumeration

CWE-345: Insufficient Verification of Data Authenticity

CWE-384: Session Fixation