CVE-2026-13356 — Interrupted navigation could allow address bar origin spoofing in Firefox for iOS
A malicious webpage could interrupt a pending navigation by enqueuing a synchronous JavaScript dialog, causing the browser UI to display the destination origin in the address ba…
Published: 2026-07-06 · CVSS: 6.3 · CVSS 3.1
A malicious webpage could interrupt a pending navigation by enqueuing a synchronous JavaScript dialog, causing the browser UI to display the destination origin in the address bar while continuing to render attacker-controlled content. This vulnerability was fixed in Firefox for iOS 152.3.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7