CVE-2026-14906

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-14906
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-14906.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-14906
Published
2026-07-13T18:27:03Z
Modified
2026-08-21T11:48:55Z
Severity
  • 5.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N CVSS Calculator
Summary
Malicious webpage titles could allow overwriting of bundled PDF resources when saving webpages as PDFs in Firefox for iOS
Details

Pages with malicious titles could potentially allow saved PDF content to overwrite PDF files or bundled content within the Firefox for iOS application sandbox. This vulnerability was fixed in Firefox for iOS 152.4.

Database specific 
{
    "cna_assigner": "mozilla",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/14xxx/CVE-2026-14906.json"
}
References

Affected packages

Git / github.com/mozilla-mobile/firefox-ios

Affected ranges

Type
GIT
Repo
https://github.com/mozilla-mobile/firefox-ios
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
1991f2b9f99100ccb509a397e84dcf6501adc0bb
Database specific
Show details 
{
    "cpe": "cpe:2.3:a:mozilla:firefox_mobile:*:*:*:*:*:iphone_os:*:*",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "152.4"
        }
    ],
    "source": "CPE_RANGE"
}

Affected versions

20.*
20.1
Other
AuroraV1
AuroraV10
AuroraV11
AuroraV13
AuroraV14
AuroraV15
AuroraV2
AuroraV3
AuroraV6
AuroraV7
AuroraV8
firefox-v142.*
firefox-v142.0
firefox-v144.*
firefox-v144.1
firefox-v144.2
firefox-v144.3
firefox-v145.*
firefox-v145.2
firefox-v146.*
firefox-v146.1
firefox-v147.*
firefox-v147.4
firefox-v147.5
firefox-v148.*
firefox-v148.1
firefox-v149.*
firefox-v149.0
firefox-v149.2
firefox-v150.*
firefox-v150.1
firefox-v151.*
firefox-v151.0
firefox-v151.1
firefox-v152.*
firefox-v152.1
focus/klar-v143.*
focus/klar-v143.0
focus/klar-v148.*
focus/klar-v148.2

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-14906.json"