Firefox for iOS Reader View replaces page content in an HTML template before substituting other internal placeholders. A malicious page can embed a placeholder string that later receives JSON‑LD data, causing arbitrary JavaScript execution within the Reader View context. The flaw falls under the Cross‑Site Scripting (CWE‑79) family, enabling code execution that could lead to data exfiltration or session hijacking if a user activates Reader View on a compromised site.

The vulnerability affects Mozilla’s Firefox for iOS. Users running Firefox for iOS prior to version 151.2 are impacted; the issue was addressed in Firefox for iOS 151.2 and later editions.

The CVSS score of 5.4 indicates a medium severity, reflecting the potential for remote code execution. The EPSS score is not available, and the flaw is not listed in the CISA KEV catalog, suggesting it is a newly identified issue with no known public exploits yet. The likely attack vector is a crafted web page that a user opens in Reader View, with the incorrect placeholder replacement triggering the payload. Because the flaw resides in browser rendering logic, it can be exploited by any user visiting a malicious site while enabling Reader View.