CVE-2026-14906 File upload in Firefox for iOS

Medium 5.3 Published 13 Jul 2026 Updated 13 Jul 2026

Attackers can overwrite bundled PDF resources in Firefox for iOS by using malicious webpage titles when saving pages as PDFs.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2026-14906?

CVE-2026-14906 is a medium-severity vulnerability in Mozilla Firefox Mobile, published on 13 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Pages with malicious titles could potentially allow saved PDF content to overwrite PDF files or bundled content within the Firefox for iOS application sandbox. This vulnerability was fixed in Firefox for iOS 152.4.

Weakness: CWE-434

Which versions are affected by CVE-2026-14906?

It affects 1 product.

Products include Mozilla Firefox Mobile.

How do I fix CVE-2026-14906?

No fix has been published for CVE-2026-14906 yet. Limit exposure of the affected software until one is available.

Is CVE-2026-14906 being exploited?

There is no known exploitation of CVE-2026-14906 in the wild and no public exploit code.

All Mozilla Firefox Mobile vulnerabilities

Sources

Also known as GHSA-prx6-r9g2-44x7.