Firefox for iOS could autofill saved credentials into a new page after cross-origin navigation while the saved-login UI was open. This behavior was not bound to the originating page or rejected when its origin changed. The result is that a user’s username and password can be inadvertently injected domain, exposing credentials to that site. This is an instance of information disclosure (CWE‑200) and could allow an attacker to harvest credentials for account compromise or phishing.

The affected product is Mozilla Firefox for iOS. Versions prior to 157.1 contain the flaw. Affected versions include Firefox for iOS 157.0 and all earlier releases.

The CVSS score is not provided, and the EPSS value is unavailable, so the precise severity and exploitation probability cannot be quantified. The vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that the attack vector involves a user navigating to a different origin while the autofill prompt is displayed, allowing a malicious site to capture the injected credentials if it can coerce the user into such navigation. No public exploits have been reported, but the potential for credential theft remains if an attacker can trick a victim into triggering the cross-origin transition while autofill is active.