CVE-2026-14906 - Malicious webpage titles could allow overwriting of bundled PDF resources when saving webpages as PDFs in Firefox for iOS

Back Back to CVE browser

MEDIUM

Malicious webpage titles could allow overwriting of bundled PDF resources when saving webpages as PDFs in Firefox for iOS

Published Jul 13, 2026

5.3

MEDIUM

CVSS 3.1

EPSS 0.29%

Description

Pages with malicious titles could potentially allow saved PDF content to overwrite PDF files or bundled content within the Firefox for iOS application sandbox. This vulnerability was fixed in Firefox for iOS 152.4.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-434

Unrestricted Upload of File

References (3)

https://bugzilla.mozilla.org/show_bug.cgi?id=2045842
Permissions Required
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-43521
Advisory
https://www.mozilla.org/security/advisories/mfsa2026-66/
Vendor Advisory

Link	Providers	Tags
https://bugzilla.mozilla.org/show_bug.cgi?id=2045842		Permissions Required
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-43521		Advisory
https://www.mozilla.org/security/advisories/mfsa2026-66/		Vendor Advisory

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner mozilla

Published Jul 13, 2026

Updated Jul 13, 2026

Reserved Jul 6, 2026

Link CVE-2026-14906

CISA Vulnrichment

Updated Jul 13, 2026

NVD

Status Analyzed

Modified Jul 14, 2026

Link CVE-2026-14906

Red Hat

No data

ENISA EUVD

Assigner mozilla

Published Jul 13, 2026

Updated Jul 13, 2026

Link EUVD-2026-43521

GitHub

No data