CVE-2026-8706

MediumCVSS 6.5/10Last modified Jul 23, 2026

Description

Firefox for iOS hosted Reader mode on an unauthenticated local web server, allowing another application on the same device to request arbitrary URLs and receive the response rendered with the signed-in user's cookies. This vulnerability was fixed in Firefox for iOS 151.0.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-200CWE-306

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published
May 19, 2026
Last modified
Jul 23, 2026
NVD status
Undergoing Analysis

Related CVEs from 2026

CVE-2026-870678.5The Forminator Forms WordPress plugin before 1.57.2.1 does not restrict which classes may be instantiated when it deserialises a value takeCVE-2026-870686.6The Forminator Forms WordPress plugin before 1.57.2.1 does not apply the role validation it enforces elsewhere when a registration form is CVE-2026-870693.1The Forminator Forms WordPress plugin before 1.57.2.1 does not perform a nonce, capability or ownership check before running a one-time payCVE-2026-87076.1The NS Product icon badge plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via PHP_SELF in all versions up to, and incluCVE-2026-870705.3The Forminator Forms WordPress plugin before 1.57.2.1 does not verify that a request came from a trusted proxy before preferring client-suppCVE-2026-870715.3The Forminator Forms WordPress plugin before 1.57.2.1 does not restrict which metadata keys a form submission may supply, and does not excluCVE-2026-870727.1Tanium addressed an improper access controls vulnerability in Comply.CVE-2026-870736.5Tanium addressed an improper access controls vulnerability in Comply.CVE-2026-870743.7The Forminator Forms WordPress plugin before 1.57.2.1 does not bind its saved-draft notification to the visitor who created the draft, and CVE-2026-870758.1Tanium addressed an improper access controls vulnerability in Comply.CVE-2026-870766.5Tanium addressed an information disclosure vulnerability in Discover.CVE-2026-870789.1Net::IDN::Punycode versions from 2.302 before 2.590 for Perl leak the output buffer on every rejected label in decode_punycode. The XS back
CVE-2026-8706: Medium severity, CVSS 6.5 | Vulnix