CVE-2026-53899 Cross-origin cookies could be leaked when opening a PDF link

What is CVE-2026-53899?

CVE-2026-53899 is a medium-severity vulnerability in Mozilla Firefox Mobile, published on 16 Jun 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Firefox for iOS used partial domain matching when attaching cookies to PDF requests, allowing a malicious site on a suffix domain to receive cookies belonging to the target site. This vulnerability was fixed in Firefox for iOS 152.0.

Weakness: CWE-345

Which versions are affected by CVE-2026-53899?

It affects 1 product.

Products include Mozilla Firefox Mobile.

How do I fix CVE-2026-53899?

No fix has been published for CVE-2026-53899 yet. Limit exposure of the affected software until one is available.

Is CVE-2026-53899 being exploited?

There is no known exploitation of CVE-2026-53899 in the wild and no public exploit code.

Other vulnerabilities in Mozilla Firefox Mobile

• CVE-2026-84135 Other issue in Firefox Focus for Android Critical 9.8
• CVE-2024-43111 Cross-site scripting in Firefox for iOS Critical 9.8
• CVE-2023-49060 Information disclosure in Firefox for iOS Critical 9.8
• CVE-2026-92033 Privilege escalation in Firefox for Android High 8.8
• CVE-2026-84117 Privilege escalation in Firefox for Android High 8.8

All Mozilla Firefox Mobile vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-848m-8qg2-wmrv.