Firefox for iOS could autofill saved credentials into a new page after cross‑origin navigation while the saved‑login UI was open. This behaviour was not tied to the originating page and was not rejected when the origin changed. The result is that a user’s username and password can be inadvertently injected into another domain, exposing credentials to that site. This is a credential disclosure (CWE‑346) vulnerability and might allow an attacker to harvest credentials for account compromise or phishing.

The affected product is Mozilla Firefox for iOS. Versions prior to 157.1 contain the flaw. Affected versions include Firefox for iOS 157.0 and all earlier releases.

Based on the information, the CVSS score of 5.5 indicates moderate severity. The EPSS score is less than 1%, suggesting a low probability that this vulnerability is actively exploited. The vulnerability is not in the CISA KEV catalog. The likely attack vector involves a user navigating to a different origin while the saved‑login UI is open, allowing a malicious site to receive injected credentials. No public exploits have been reported, but credential theft is possible if an attacker can trick a victim into navigating away while autofill is active.