CVE-2026-53899

Cross-origin cookies could be leaked when opening a PDF link

Published Jun 16, 2026 CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Description

Firefox for iOS used partial domain matching when attaching cookies to PDF requests, allowing a malicious site on a suffix domain to receive cookies belonging to the target site. This vulnerability was fixed in Firefox for iOS 152.0.

Analysis

Technical impact

Firefox for iOS previously matched cookies to requests using partial domain matching, which allowed a malicious site on a suffix domain to receive cookies that belong to a target domain when the user clicks a PDF link. This vulnerability could enable an attacker to steal authentication or session cookies and hijack user sessions. The weakness is classified as CWE‑345, reflecting a scenario of partial trust boundary violation.

Affected Systems

The affected product is Firefox for iOS. Any installation before version 152.0 is prone to exploitation; the issue was resolved in Firefox for iOS 152.0 and later releases.

Risk and Exploitability

The CVSS score of 6.5 indicates a moderate severity. The EPSS score of less than 1% suggests that exploitation is currently unlikely, and the vulnerability is not listed in the CISA KEV catalog. Nonetheless, the attack vector involves a malicious suffix domain that can retrieve cookies by opening a PDF link, so the risk of exploitation may materialize if the attacker can persuade a user to click such links.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Mozilla

Firefox for iOS

affected

Version	Status	Constraints
`152.0`	unaffected	≤ *

Configuration 1 [-]

cpe:2.3:a:mozilla:firefox_mobile:*:*:*:*:*:iphone_os:*:*

No data.

Vendor Product Versions

Mozilla

Firefox For Ios

Version	Status	Scheme	Platform
`[152.0,*]`	unaffected	generic	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade Firefox for iOS to version 152.0 or later to receive the fix for the cookie handling bug.
If an upgrade is not immediately possible, restrict the ability to open PDF links from untrusted sources or consider disabling PDF handling in the app to prevent the partial domain matching issue.
Monitor for phishing emails or websites that embed PDF links and use suffix domain domains, and block or warn users accordingly.

Generated by OpenCVE AI on June 17, 2026 at 21:39 UTC.

Tracking

Advisories

No advisories available

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.096% probability within 30 days)

Exploitation none

Automatable yes

Technical Impact partial

References

Link	Providers
https://bugzilla.mozilla.org/show_bug.cgi?id=2042909
https://www.mozilla.org/security/advisories/mfsa2026-56/

History

Jun 16, 2026 5:30 PM Weaknesses updated. Scoring metrics updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-345
Metrics		cvssV3_1 `{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N'}` ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Jun 16, 2026 4:00 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Mozilla Mozilla firefox For Ios
Vendors & Products		Mozilla Mozilla firefox For Ios

Jun 16, 2026 1:15 PM Description updated. Title updated. Added references View changes

Type	Values Removed	Values Added
Description		Firefox for iOS used partial domain matching when attaching cookies to PDF requests, allowing a malicious site on a suffix domain to receive cookies belonging to the target site. This vulnerability was fixed in Firefox for iOS 152.0.
Title		Cross-origin cookies could be leaked when opening a PDF link
References		https://bugzilla.mozilla.org/show_bug.cgi?id=2042909 https://www.mozilla.org/security/advisories/mfsa2026-56/