Firefox for iOS directly embedded the page’s HTML language attribute into translation JavaScript without sanitization. This allows an attacker to supply malicious markup that is executed with privileged content world privileges, bypassing the page’s Content Security Policy. The result is a form of cross‑site scripting that grants the attacker arbitrary code execution in the browser context.

Mozilla Firefox for iOS users running any version earlier than 157.1 are affected. The vulnerability was fixed in version 157.1, and no other vendors or product lines are cited in the advisory.

The CVSS score of 8.8 indicates high severity. The EPSS score of <1% suggests that active exploitation is currently unlikely, but the opportunistic nature of the XSS means an attacker could still craft a malicious page that sets a harmful language attribute to inject code. The likely attack vector is delivering such a crafted page to a victim using Firefox for iOS. Even without a publicly known exploit, the vulnerability can be leveraged by anyone capable of hosting the malicious page, granting remote code execution with elevated privileges. The vulnerability is not listed in the CISA KEV catalog.