CVE-2026-103418: Universal XSS via the HTML language attribute in Translation Services

Q: Which deployments need to be remediated?

Firefox for iOS is the affected product identified in the vulnerability details. The issue is fixed in Firefox for iOS 157.1.

Q: What attacker-controlled input is involved in exploitation?

An attacker needs control of a webpage’s HTML language attribute. That value can be interpolated into translation JavaScript as attacker-controlled markup.

Q: Does a page Content Security Policy prevent exploitation?

No. The issue allows code execution in Firefox’s privileged content world and bypasses the page’s Content Security Policy.

Published Oct 5, 2026

Updated

Firefox for iOS directly interpolated the page’s HTML language attribute into translation JavaScript, allowing attacker-controlled markup to execute code in Firefox’s privileged content world and bypass the page’s Content Security Policy.

Affected Software

3 affected components

Mozilla Firefox for iOS<157.1

All of the following

Mozilla Firefox=157.1

Apple iOS

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Firefox for iOS to a version that resolves this vulnerability.
Fixed in 157.1

Event History

Oct 5, 2026

CVE Published

via Mozilla·12:00 AM

Data Sourced

via Mozilla·12:00 AM

DescriptionSeverityAffected Software

Oct 13, 2026

CVE Published

via MITRE·07:19 AM

Data Sourced

via MITRE·07:19 AM

Description

Data Sourced

via NVD·08:16 AM

Description

Parent advisories

This vulnerability appears in the following advisories.

MFSA2026-105

Peer vulnerabilities

Found alongside the following vulnerabilities.

Frequently Asked Questions

Which deployments need to be remediated?

Firefox for iOS is the affected product identified in the vulnerability details. The issue is fixed in Firefox for iOS 157.1.

What attacker-controlled input is involved in exploitation?

An attacker needs control of a webpage’s HTML language attribute. That value can be interpolated into translation JavaScript as attacker-controlled markup.

Does a page Content Security Policy prevent exploitation?

No. The issue allows code execution in Firefox’s privileged content world and bypasses the page’s Content Security Policy.

CVE-2026-103418: Universal XSS via the HTML language attribute in Translation Services

Affected Software

Remediation

Event History

Parent advisories

Peer vulnerabilities

Frequently Asked Questions

Which deployments need to be remediated?

What attacker-controlled input is involved in exploitation?

Does a page Content Security Policy prevent exploitation?

Company

Resources

Contact

Frequently Asked Questions

Which deployments need to be remediated?

What attacker-controlled input is involved in exploitation?

Does a page Content Security Policy prevent exploitation?