CVE-2026-86853

MediumCVSS 4.3/10Last modified Oct 5, 2026

Description

A malicious webpage could repeatedly trigger external URL schemes, causing system prompts or external application launches. This could make Firefox for iOS temporarily unusable until the page is closed. This vulnerability was fixed in Firefox for iOS 155.1.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L

Weakness enumeration

CWE-451

Affected software

Vendor	Product	Versions
Mozilla	Firefox for iOS	—

References

https://bugzilla.mozilla.org/show_bug.cgi?id=1847631Permissions Required
https://www.mozilla.org/security/advisories/mfsa2026-89/Vendor Advisory

Timeline

Published: Sep 8, 2026
Last modified: Oct 5, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-868566.5A flaw was found in the DPDK nfp vDPA driver. Stack and heap buffers sized for a single queue pair can be overflowed when more virtqueues ar CVE-2026-868578.4ServiceNow has remediated an authorization bypass security issue that was identified in the ServiceNow AI Platform. This security issue, if CVE-2026-868588.7ServiceNow has remediated an improper access control security issue that was identified in the ServiceNow AI Platform. This security issue c CVE-2026-868598.7ServiceNow has remediated an authorization bypass security issue that was identified in the ServiceNow AI Platform. This security issue, if CVE-2026-86869.1Missing bounds validation in the MQTT v5.0 property parser in coreMQTT before 5.0.1 allows an MQTT broker to cause a denial of service by se CVE-2026-868609.3ServiceNow has remediated a missing authorization vulnerability that was identified in the ServiceNow AI Platform. This vulnerability could CVE-2026-868615.9pgAdmin 4's File Manager save_file endpoint, which backs saving from the Query Tool and ERD, validated the requested path with Filemanager.c CVE-2026-868626.5pgAdmin 4's Restore and Maintenance tools passed the client-supplied 'database' field directly as the value of the --dbname option given to CVE-2026-868639.8pgAdmin 4's Webserver authentication source is intended to accept an identity asserted by the web server or reverse proxy in front of pgAdmi CVE-2026-868648.8pgAdmin 4's Backup tool appended the client-supplied 'database' field from the /backup/job/<sid>/object request to the pg_dump argument vect CVE-2026-868657.2Tanium addressed a SQL injection vulnerability in Asset.CVE-2026-868676.5Cinnamon's Kotaemon (all versions up to and including v0.12.0) multi-user chat interface contains multiple vulnerabilities due to incorrect