CVE-2026-103417: Saved credentials can be autofilled after cross-origin navigation

Severity: medium (CVSS 5.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-10-13 · updated 2026-10-13
Weakness: CWE-346

Description

Firefox for iOS could autofill saved credentials into a new page if cross-origin navigation occurred while the saved-login UI was open. Autofill was not bound to the originating page or rejected when its origin changed. This vulnerability was fixed in Firefox for iOS 157.1.

References

https://bugzilla.mozilla.org/show_bug.cgi?id=2068171
https://www.mozilla.org/security/advisories/mfsa2026-105/

Get alerted when CVE-2026-103417 or the next vulnerability affects your stack