CVE-2026-103418: Universal XSS via the HTML language attribute in Translation Services
Firefox for iOS directly interpolated the page’s HTML language attribute into translation JavaScript, allowing attacker-controlled markup to execute code in Firefox’s privileged content world and bypass the page’s Content Security Policy.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Firefox for iOSto a version that resolves this vulnerability.Fixed in 157.1
Event History
Frequently Asked Questions
Which deployments need to be remediated?
Firefox for iOS is the affected product identified in the vulnerability details. The issue is fixed in Firefox for iOS 157.1.
What attacker-controlled input is involved in exploitation?
An attacker needs control of a webpage’s HTML language attribute. That value can be interpolated into translation JavaScript as attacker-controlled markup.
Does a page Content Security Policy prevent exploitation?
No. The issue allows code execution in Firefox’s privileged content world and bypasses the page’s Content Security Policy.