CVE-2026-86853: Repeated external URL scheme launches could potentially cause a denial of service in Firefox for iOS

Severity: medium (CVSS 4.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-09-08 · updated 2026-10-05
Weakness: CWE-451

Description

A malicious webpage could repeatedly trigger external URL schemes, causing system prompts or external application launches. This could make Firefox for iOS temporarily unusable until the page is closed. This vulnerability was fixed in Firefox for iOS 155.1.

Affected products

Mozilla Firefox for Android: before 155.1 — fixed in 155.1

How to fix

Upgrade to a fixed version: Mozilla Firefox for Android 155.1. Check the vendor advisory for mitigations.

References

https://bugzilla.mozilla.org/show_bug.cgi?id=1847631
https://www.mozilla.org/security/advisories/mfsa2026-89/

Get alerted when CVE-2026-86853 or the next vulnerability affects your stack