CVE-2023-49060 Information disclosure in Firefox for iOS

What is CVE-2023-49060?

CVE-2023-49060 is a critical vulnerability in Mozilla Firefox Mobile, published on 21 Nov 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

An attacker could have accessed internal pages or data by ex-filtrating a security key from ReaderMode via the `referrerpolicy` attribute. This vulnerability affects Firefox for iOS < 120.

Which versions are affected by CVE-2023-49060?

It affects 1 product.

Products include Mozilla Firefox Mobile.

How do I fix CVE-2023-49060?

No fix has been published for CVE-2023-49060 yet. Limit exposure of the affected software until one is available.

Is CVE-2023-49060 being exploited?

There is no known exploitation of CVE-2023-49060 in the wild and no public exploit code.

Other vulnerabilities in Mozilla Firefox Mobile

• CVE-2026-84135 Other issue in Firefox Focus for Android Critical 9.8
• CVE-2024-43111 Cross-site scripting in Firefox for iOS Critical 9.8
• CVE-2026-92033 Privilege escalation in Firefox for Android High 8.8
• CVE-2026-84117 Privilege escalation in Firefox for Android High 8.8
• CVE-2021-29993 Other in Firefox High 8.1

All Mozilla Firefox Mobile vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-2pmg-xgx9-g8w8.