CVE-2026-103417: Saved credentials can be autofilled after cross-origin navigation
Firefox for iOS could autofill saved credentials into a new page if cross-origin navigation occurred while the saved-login UI was open. Autofill was not bound to the originating page or rejected when its origin changed.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Firefox for iOSto a version that resolves this vulnerability.Fixed in 157.1
Event History
Frequently Asked Questions
Which Firefox for iOS versions need to be updated?
The issue was fixed in Firefox for iOS 157.1. Devices running an earlier Firefox for iOS version should be updated to 157.1 or later.
What conditions are required for credentials to be exposed?
A saved-login autofill interface must be open, and a cross-origin navigation must occur before autofill completes. The autofill action could then place saved credentials into the newly loaded page rather than the page that opened the saved-login UI.
Does exploitation require an authenticated account or elevated privileges?
The CVSS vector indicates no privileges are required and user interaction is required. The attack vector is local, and the impact is limited to confidentiality.