CVE-2026-81267 Stalled popup navigation could allow address bar origin spoofing in Firefox for iOS

Medium 5.4 Published 31 Aug 2026 Updated 31 Aug 2026

A malicious webpage can spoof the address bar origin in Firefox for iOS by stalling popup navigation, misleading users about the site's identity.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: None listed

What is CVE-2026-81267?

CVE-2026-81267 is a medium-severity vulnerability in Mozilla Firefox Mobile, published on 31 Aug 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

A malicious webpage could stall a popup's cross-origin navigation after commit, causing the address bar to display the destination origin while continuing to render attacker-controlled content. This vulnerability was fixed in Firefox for iOS 155.0.

Weakness: CWE-451

Which versions are affected by CVE-2026-81267?

It affects 1 product.

Products include Mozilla Firefox Mobile.

How do I fix CVE-2026-81267?

No fix has been published for CVE-2026-81267 yet. Limit exposure of the affected software until one is available.

Is CVE-2026-81267 being exploited?

There is no known exploitation of CVE-2026-81267 in the wild and no public exploit code.

All Mozilla Firefox Mobile vulnerabilities

Sources

Also known as GHSA-pp56-4328-qwfp.