CVE-2026-14906: Firefox Mobile Privilege Escalation Flaw

CVE-2026-14906 Overview

CVE-2026-14906 affects Mozilla Firefox for iOS, where pages with malicious titles can cause saved PDF content to overwrite existing PDF files or bundled application content inside the Firefox for iOS sandbox. The flaw is categorized as an unrestricted file upload weakness [CWE-434]. A remote attacker can trigger the issue by luring a user to a crafted web page whose title influences the destination filename when a PDF is saved. Mozilla fixed the issue in Firefox for iOS 152.4 and documented it in advisory MFSA-2026-66.

Critical Impact
Malicious web page titles can overwrite arbitrary PDF files or bundled resources within the Firefox for iOS sandbox, corrupting user-saved content or trusted application assets.

Affected Products

Mozilla Firefox for iOS versions prior to 152.4
Deployments on Apple iPhone OS (iphone_os)
Users who save PDF content generated from untrusted web pages

Discovery Timeline

2026-07-13 - CVE-2026-14906 published to NVD
2026-07-14 - Last updated in NVD database

Technical Details for CVE-2026-14906

Vulnerability Analysis

The vulnerability resides in the PDF save workflow of Firefox for iOS. When a user saves page content as a PDF, the browser derives the output filename from the HTML document title. Firefox for iOS did not sufficiently sanitize this title before using it as a filename inside the app sandbox. As a result, a crafted title containing path characters or matching an existing filename can cause the saved PDF to overwrite files already present in the sandbox, including previously saved PDFs and files bundled with the application.

The issue is scoped to the Firefox for iOS sandbox and cannot reach outside the application container due to iOS platform isolation. Impact is limited to integrity of files inside that sandbox, which is why the advisory carries a limited confidentiality-only rating in NVD.

Root Cause

The root cause is improper input validation of the HTML <title> element when constructing the filename for saved PDF output [CWE-434]. Firefox for iOS trusted attacker-controlled content as safe filename input, allowing collision with or replacement of existing sandboxed files.

Attack Vector

Exploitation requires a user to visit an attacker-controlled page in Firefox for iOS and initiate the save-as-PDF action. The attacker sets the page title to a value that resolves to an existing PDF path or bundled resource inside the Firefox sandbox. When Firefox writes the new PDF, it overwrites the target file. No authentication is required, and the attack occurs over the network via standard web content delivery.

No public proof-of-concept code is available. Refer to the Mozilla Bug Report #2045842 and Mozilla Security Advisory MFSA-2026-66 for vendor technical details.

Detection Methods for CVE-2026-14906

Indicators of Compromise

Unexpected modification timestamps on PDF files previously saved through Firefox for iOS
Corrupted or replaced Firefox bundled resources within the app sandbox
Browsing history entries pointing to pages with unusually long or path-like <title> values immediately before file corruption reports

Detection Strategies

Inventory installed Firefox for iOS versions across the mobile fleet and flag builds earlier than 152.4
Correlate mobile device management (MDM) telemetry with reports of unexpected PDF file changes on managed iOS devices
Review web proxy logs for pages whose HTML titles contain filename delimiters or reference known Firefox bundled asset names

Monitoring Recommendations

Track Firefox for iOS version distribution through your MDM platform and alert on out-of-date installations
Monitor user reports of missing or altered saved PDFs on iOS devices
Ingest browser and mobile telemetry into a central data lake to correlate suspicious page visits with subsequent file integrity anomalies

How to Mitigate CVE-2026-14906

Immediate Actions Required

Update Firefox for iOS to version 152.4 or later on all managed and BYOD devices
Advise users to avoid saving PDFs from untrusted or unfamiliar websites until the update is applied
Communicate the risk of overwritten saved PDFs to users who handle sensitive documents in Firefox for iOS

Patch Information

Mozilla addressed CVE-2026-14906 in Firefox for iOS 152.4. Details are published in the Mozilla Security Advisory MFSA-2026-66 and the underlying Mozilla Bug Report #2045842. Deploy the update through the Apple App Store or your MDM application catalog.

Workarounds

Use an alternative browser or Apple's native Share to Files workflow for saving PDFs until Firefox for iOS is updated
Restrict use of Firefox for iOS on managed devices via MDM configuration until version 152.4 is deployed
Back up important saved PDFs to iCloud or another store outside the Firefox sandbox to preserve integrity

bash

# Example MDM query to identify vulnerable Firefox for iOS installations
# Replace with your MDM's actual query syntax
app.bundleId == "org.mozilla.ios.Firefox" AND app.version < "152.4"