CVE-2026-53900 — Cookie injection was possible when opening a PDF link
Firefox for iOS preserved cookies set on the initial PDF request across cross-origin HTTP redirects in TemporaryDocument, allowing a malicious site to inject arbitrary cookies i…
Published: 2026-06-16 · CVSS: 4.3 · CVSS 3.1
Firefox for iOS preserved cookies set on the initial PDF request across cross-origin HTTP redirects in TemporaryDocument, allowing a malicious site to inject arbitrary cookies into requests to an unrelated target domain. This vulnerability was fixed in Firefox for iOS 152.0.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7