Description
A malicious web page could insert arbitrary text into the FaceTime call prompt shown by iOS, potentialy allowing it to display a phishing message inside system UI. This vulnerability was fixed in Firefox for iOS 156.1.
Published: 2026-10-26
Score: 5.4 Medium
EPSS: n/a
KEV: No
Impact: Phishing via system UI spoofing
Action: Immediate Patch
AI Analysis

Impact

A malicious web page can inject arbitrary text into the FaceTime call prompt displayed by iOS, allowing an attacker to display a phishing message within system UI. This flaw enables social‑engineering attacks by impersonating legitimate FaceTime requests.

Affected Systems

Mozilla Firefox for iOS versions earlier than 156.1 are vulnerable. The issue was fixed in Firefox for iOS 156.1 and later. Users running any unsupported or older Firefox for iOS editions should be aware.

Risk and Exploitability

The vulnerability has a CVSS score of 5.4. It is exploitable by visiting a malicious web page presented through a normal browsing session; no special privileges are required. The EPSS score is unavailable, and the vulnerability is not listed in CISA's KEV catalog. However, the medium potential for user deception and the absence of protective mitigations mean that the risk to users is significant. Attackers must craft a page that triggers the FaceTime protocol handler, implying network access to deliver the malicious content and reliance on user interaction to reveal the spoofed UI.

Generated by OpenCVE AI on October 26, 2026 at 20:51 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade Firefox for iOS to version 156.1 or newer
  • Ensure the installed application is obtained from the official App Store and has not been tampered with
  • Avoid clicking on FaceTime prompts from untrusted web pages; consider disabling automatic FaceTime calls in browser settings or using site‑restricting extensions

Generated by OpenCVE AI on October 26, 2026 at 20:51 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 26 Oct 2026 21:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-200
CWE-74

Mon, 26 Oct 2026 19:45:00 +0000

Type Values Removed Values Added
Weaknesses CWE-200
CWE-74

Mon, 26 Oct 2026 19:30:00 +0000

Type Values Removed Values Added
First Time appeared Mozilla
Mozilla firefox For Ios
Weaknesses CWE-451
Vendors & Products Mozilla
Mozilla firefox For Ios
Metrics cvssV3_1

{'score': 5.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L'}

Mon, 26 Oct 2026 18:45:00 +0000

Type Values Removed Values Added
Description A malicious web page could insert arbitrary text into the FaceTime call prompt shown by iOS, potentialy allowing it to display a phishing message inside system UI. This vulnerability was fixed in Firefox for iOS 156.1.
Title Facetime protocol handler enabled spoofing
References

Subscriptions

Mozilla Firefox For Ios
cve-icon MITRE

Status: PUBLISHED

Assigner: mozilla

Published:

Updated: 2026-10-26T18:56:21.288Z

Reserved: 2026-10-26T17:52:54.679Z

Link: CVE-2026-116632

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-10-26T19:16:30.947

Modified: 2026-10-26T19:16:30.947

Link: CVE-2026-116632

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-26T21:00:10Z

Weaknesses
  • CWE-451

    User Interface (UI) Misrepresentation of Critical Information