CVE-2026-103417: Saved credentials can be autofilled after cross-origin navigation

Q: Which Firefox for iOS versions need to be updated?

The issue was fixed in Firefox for iOS 157.1. Devices running an earlier Firefox for iOS version should be updated to 157.1 or later.

Q: What conditions are required for credentials to be exposed?

A saved-login autofill interface must be open, and a cross-origin navigation must occur before autofill completes. The autofill action could then place saved credentials into the newly loaded page rather than the page that opened the saved-login UI.

Q: Does exploitation require an authenticated account or elevated privileges?

The CVSS vector indicates no privileges are required and user interaction is required. The attack vector is local, and the impact is limited to confidentiality.

Published Oct 5, 2026

Updated

Firefox for iOS could autofill saved credentials into a new page if cross-origin navigation occurred while the saved-login UI was open. Autofill was not bound to the originating page or rejected when its origin changed.

Affected Software

3 affected components

Mozilla Firefox for iOS<157.1

All of the following

Mozilla Firefox=157.1

Apple iOS

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Firefox for iOS to a version that resolves this vulnerability.
Fixed in 157.1

Event History

Oct 5, 2026

CVE Published

via Mozilla·12:00 AM

Data Sourced

via Mozilla·12:00 AM

DescriptionSeverityAffected Software

Oct 13, 2026

CVE Published

via MITRE·07:19 AM

Data Sourced

via MITRE·07:19 AM

Description

Data Sourced

via NVD·08:16 AM

DescriptionSeverityWeakness

Parent advisories

This vulnerability appears in the following advisories.

MFSA2026-105

Peer vulnerabilities

Found alongside the following vulnerabilities.

Frequently Asked Questions

Which Firefox for iOS versions need to be updated?

The issue was fixed in Firefox for iOS 157.1. Devices running an earlier Firefox for iOS version should be updated to 157.1 or later.

What conditions are required for credentials to be exposed?

A saved-login autofill interface must be open, and a cross-origin navigation must occur before autofill completes. The autofill action could then place saved credentials into the newly loaded page rather than the page that opened the saved-login UI.

Does exploitation require an authenticated account or elevated privileges?

The CVSS vector indicates no privileges are required and user interaction is required. The attack vector is local, and the impact is limited to confidentiality.

CVE-2026-103417: Saved credentials can be autofilled after cross-origin navigation

Affected Software

Remediation

Event History

Parent advisories

Peer vulnerabilities

Frequently Asked Questions

Which Firefox for iOS versions need to be updated?

What conditions are required for credentials to be exposed?

Does exploitation require an authenticated account or elevated privileges?

Company

Resources

Contact

Frequently Asked Questions

Which Firefox for iOS versions need to be updated?

What conditions are required for credentials to be exposed?

Does exploitation require an authenticated account or elevated privileges?