CVE-2026-9308

Firefox for iOS Reader View replaced page content in its HTML template before replacing other internal placeholders. A malicious page could include a placeholder string that was later substituted with JSON-LD data, potentially resulting in arbitrary JavaScript execution. This vulnerability was fixed in Firefox for iOS 151.2.

• CWE-79

• https://bugzilla.mozilla.org/show_bug.cgi?id=2039422Permissions Required
• https://www.mozilla.org/security/advisories/mfsa2026-53/Vendor Advisory

Published

Jun 1, 2026

Last Modified

Jul 22, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-9302A vulnerability was determined in 546669204 vps-inventory-mo…6.3
• CVE-2026-9303A vulnerability was identified in calcom cal.diy up to 4.9.4…4.3
• CVE-2026-9304A security flaw has been discovered in calcom cal.diy up to …5
• CVE-2026-9305A weakness has been identified in QuantumNous new-api up to …6.3
• CVE-2026-9306A security vulnerability has been detected in QuantumNous ne…3.7
• CVE-2026-9307A sensitive information disclosure security issue exists wit…6.3
• CVE-2026-9309Firefox for iOS Reader View did not properly escape HTML tag…5.4
• CVE-2026-9311IBM WebSphere Application Server 9.0, and 8.5 is vulnerable …9
• CVE-2026-9312A server-side request forgery (SSRF) vulnerability was ident…8.2
• CVE-2026-9318tablib prior to 3.10.0 contains a stored cross-site scriptin…5.4
• CVE-2026-9319IBM WebSphere Application Server 9.0, and 8.5 is vulnerable …9
• CVE-2026-9320IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSph…7.5