PatchTheCVECVE-2026-53899: Firefox for iOS used partial domain matching when attaching cookies to PDF requests, allowing a malicious site
CVE-2026-53899 is a medium-severity flaw (CVSS 6.5) affecting firefox mobile. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
Firefox for iOS used partial domain matching when attaching cookies to PDF requests, allowing a malicious site on a suffix domain to receive cookies belonging to the target site. This vulnerability was fixed in Firefox for iOS 152.0.
Why this priority
- Remotely exploitable, no login, no user action
A fixed release or distro patch exists.
Risk facts
| CVSS score | 6.5 (Medium) |
| Attack vector | Network (remote) |
| Attack complexity | Low |
| Privileges needed | None |
| User interaction | None |
| EPSS exploit chance | 0.1% (top 99%) |
| CISA exploited list | No |
| Weakness | CWE-345 |
| Published | 2026-06-16 |
| Last modified | 2026-10-26 |
Last updated 2026-10-26 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2026-53899?
firefox mobile: upgrade to 152.0. Exact commands for each OS are on this page.
Is CVE-2026-53899 being exploited?
CVE-2026-53899 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2026-53899 affect?
CVE-2026-53899 affects firefox mobile. Severity is medium (CVSS 6.5). Firefox for iOS used partial domain matching when attaching cookies to PDF requests, allowing a malicious site on a suffix domain to receive cookies belonging to the target site. This vulnerability was fixed in Firefox for iOS 152.0.
How urgent is CVE-2026-53899?
Priority 28/100. Remotely exploitable, no login, no user action
Software pages
iOS vulnerabilities · Mozilla Firefox vulnerabilities
Related CVEs
- CVE-2026-14906 MEDIUM 5.3 UPGRADE Pages with malicious titles could potentially allow saved PDF content to overwrite PDF files or bundled conten
- CVE-2026-16373 HIGH 7.5 UPGRADE Information disclosure in the Privacy component in Firefox for Android
- CVE-2026-16404 HIGH 7.4 UPGRADE Spoofing issue in Firefox for Android
- CVE-2023-29550 HIGH 8.8 UPGRADE UPGRADE Memory safety bugs present in Firefox 111 and Firefox ESR 102.9
- CVE-2023-29535 MEDIUM 6.5 UPGRADE UPGRADE Following a Garbage Collector compaction, weak maps may have been accessed before they were correctly traced