CVE-2026-116631: External protocol handler (tel:) address bar spoof

Q: Who is exposed to this issue?

Users of Firefox for iOS before version 156.1 are exposed when they visit a malicious web page that triggers a tel link in a window displaying a different website.

Q: What does an attacker need to do to exploit it?

An attacker needs to control or persuade a user to visit a malicious web page. The page can open a tel link in another window so that the phone-call prompt appears to have been requested by the site already shown in that window.

Q: How can the issue be remediated?

Update Firefox for iOS to version 156.1, which fixes the vulnerability.

Published Oct 26, 2026

Updated

A malicious web page could open a tel link in a window that was showing a different website, causing the phone-call prompt to appear as if that site had requested the call.

Affected Software

3 affected components

Mozilla Firefox for iOS<156.1

All of the following

Mozilla Firefox=156.1

Apple iOS

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Firefox for iOS to a version that resolves this vulnerability.
Fixed in 156.1

Event History

Oct 26, 2026

CVE Published

via Mozilla·12:00 AM

Data Sourced

via Mozilla·12:00 AM

DescriptionSeverityAffected Software

CVE Published

via MITRE·06:32 PM

Data Sourced

via MITRE·06:32 PM

Description

Parent advisories

This vulnerability appears in the following advisories.

MFSA2026-117

Peer vulnerabilities

Found alongside the following vulnerabilities.

Frequently Asked Questions

Who is exposed to this issue?

Users of Firefox for iOS before version 156.1 are exposed when they visit a malicious web page that triggers a tel link in a window displaying a different website.

What does an attacker need to do to exploit it?

An attacker needs to control or persuade a user to visit a malicious web page. The page can open a tel link in another window so that the phone-call prompt appears to have been requested by the site already shown in that window.

How can the issue be remediated?

Update Firefox for iOS to version 156.1, which fixes the vulnerability.

CVE-2026-116631: External protocol handler (tel:) address bar spoof

Affected Software

Remediation

Event History

Parent advisories

Peer vulnerabilities

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to do to exploit it?

How can the issue be remediated?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to do to exploit it?

How can the issue be remediated?