CVE-2026-86853: Repeated external URL scheme launches could potentially cause a denial of service in Firefox for iOS
A malicious webpage could repeatedly trigger external URL schemes, causing system prompts or external application launches. This could make Firefox for iOS temporarily unusable until the page is closed.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Firefox for iOSto a version that resolves this vulnerability.Fixed in 155.1
Event History
Frequently Asked Questions
Which users are exposed?
Firefox for iOS users running versions before 155.1 are exposed when they visit a malicious webpage that repeatedly triggers external URL schemes.
What does successful exploitation require?
An attacker needs to get a user to load a malicious webpage. The page can repeatedly trigger external URL schemes, leading to system prompts or external application launches.
What is the practical impact?
Firefox for iOS can become temporarily unusable due to repeated prompts or launches. The condition persists until the affected page is closed.
What should be done if updating is not immediately possible?
Close the offending webpage if repeated system prompts or external application launches occur. Updating Firefox for iOS to version 155.1 addresses the issue.