1. Home
  2. CVE Database
  3. CVE-2026-8706
MEDIUM · 6.5

CVE-2026-8706

Firefox for iOS hosted Reader mode on an unauthenticated local web server, allowing another application on the same device to request arbitrary URLs and receive the response rendered with the signed-i...

Vulnerability Description

Firefox for iOS hosted Reader mode on an unauthenticated local web server, allowing another application on the same device to request arbitrary URLs and receive the response rendered with the signed-in user's cookies. This vulnerability was fixed in Firefox for iOS 151.0.

CVSS Score

6.5

MEDIUM

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack Vector
ADJACENT_NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
HIGH
Integrity
NONE
Availability
NONE

Affected Products

VendorProductVersions
MozillaFirefox< 151.0

Related Weaknesses (CWE)

CWE-306CWE-200

References

FAQ

What is CVE-2026-8706?

CVE-2026-8706 is a vulnerability with a CVSS score of 6.5 (MEDIUM). Firefox for iOS hosted Reader mode on an unauthenticated local web server, allowing another application on the same device to request arbitrary URLs and receive the response rendered with the signed-i...

How severe is CVE-2026-8706?

CVE-2026-8706 has been rated MEDIUM with a CVSS base score of 6.5/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2026-8706?

Check the references section above for vendor advisories and patch information. Affected products include: Mozilla Firefox.