A flaw in Firefox for iOS allowed a malicious website to inject arbitrary cookies into requests to unrelated domains when a PDF link was opened. The vulnerability stemmed from the browser preserving cookies set on the initial PDF request across cross‑origin HTTP redirects handled in a TemporaryDocument. As a result, an attacker could forge authentication tokens, hijack sessions, or inject tracking data, thereby affecting the confidentiality and integrity of user information.

Mozilla Firefox for iOS users running any version prior to 152.0 were affected. The issue was fixed in Firefox for iOS 152.0; later releases are not vulnerable.

The CVSS score of 4.3 indicates moderate severity, but the EPSS score of less than 1% signals a very low probability of exploitation in the wild, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a malicious site hosting a PDF that redirects to a target domain, leveraging the temporary document’s cookie preservation across cross‑origin redirects.