CVE-2026-53899 — Cross-origin cookies could be leaked when opening a PDF link
Firefox for iOS used partial domain matching when attaching cookies to PDF requests, allowing a malicious site on a suffix domain to receive cookies belonging to the target site…
Published: 2026-06-16 · CVSS: 6.5 · CVSS 3.1
Firefox for iOS used partial domain matching when attaching cookies to PDF requests, allowing a malicious site on a suffix domain to receive cookies belonging to the target site. This vulnerability was fixed in Firefox for iOS 152.0.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7