Firefox for iOS fails to honour a Content-Disposition header of type attachment for certain MIME types, causing the content to be rendered inline rather than downloaded. This behavior can enable cross‑site scripting attacks because malicious scripts embedded in the content are executed in the browser context. The weakness is classified as CWE‑640, reflecting improper handling of a security‑critical header setting.

Mozilla Firefox for iOS. Versions prior to 142 are affected, as the fix was introduced in Firefox for iOS 142.

The CVSS score of 6.1 indicates a moderate severity flaw. The EPSS score of less than 1% suggests that the likelihood of exploitation is low at the time of this analysis. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires an attacker to deliver content that the browser will render inline; a user must interact with or view the manipulated content, which makes the attack vector user‑dependent rather than purely remote.