CVE-2026-14906: Malicious webpage titles could allow overwriting of bundled PDF resources when saving webpages as PDFs in Firefox for iOS

Severity: medium (CVSS 5.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-07-13 · updated 2026-10-24
Weakness: CWE-434

Description

Pages with malicious titles could potentially allow saved PDF content to overwrite PDF files or bundled content within the Firefox for iOS application sandbox. This vulnerability was fixed in Firefox for iOS 152.4.

Affected products

Mozilla Firefox for Android: before 152.4 — fixed in 152.4

How to fix

Upgrade to a fixed version: Mozilla Firefox for Android 152.4. Check the vendor advisory for mitigations.

References

https://bugzilla.mozilla.org/show_bug.cgi?id=2045842
https://www.mozilla.org/security/advisories/mfsa2026-66/

Get alerted when CVE-2026-14906 or the next vulnerability affects your stack