CVE-2026-86853: Firefox for iOS DOS Vulnerability

CVE-2026-86853 Overview

CVE-2026-86853 is a medium-severity denial-of-service vulnerability in Firefox for iOS. A malicious webpage can repeatedly trigger external URL schemes, forcing the browser to display recurring system prompts or launch external applications. The behavior renders Firefox for iOS temporarily unusable until the offending tab is closed. Mozilla addressed the flaw in Firefox for iOS 155.1. The issue is classified under CWE-451: User Interface (UI) Misrepresentation of Critical Information, reflecting the abuse of user-facing prompts as an attack surface.

Critical Impact
A malicious page can lock the browser UI through prompt flooding and external application launches, requiring users to force-close the tab to recover.

Affected Products

Mozilla Firefox for iOS versions prior to 155.1
iOS devices running the vulnerable Firefox build
Any user session where a malicious webpage is loaded in Firefox for iOS

Discovery Timeline

2026-09-08 - CVE-2026-86853 published to the National Vulnerability Database
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-86853

Vulnerability Analysis

The vulnerability abuses the way Firefox for iOS handles external URL schemes such as tel:, sms:, mailto:, and third-party application handlers. A webpage can programmatically navigate to these schemes without meaningful rate limiting. Each navigation surfaces a confirmation prompt or triggers the iOS handoff to an external application. Repeated invocation locks the browser into a loop of prompts and context switches. Users lose the ability to interact with normal browser controls until the tab is terminated. The impact is limited to availability of the browsing session and does not compromise confidentiality or integrity.

Root Cause

The root cause is missing throttling or user-gesture enforcement around scripted navigations to external URL schemes. The renderer accepts successive scheme invocations from a single page context without deduplicating or suppressing prompts. This aligns with [CWE-451], where UI elements intended to convey control to the user are weaponized to obstruct that control.

Attack Vector

Exploitation requires the victim to visit an attacker-controlled webpage in Firefox for iOS. No authentication or privileges are needed. The attacker embeds JavaScript that repeatedly assigns external scheme URLs to window.location or injects hidden iframes targeting handler schemes. Each assignment causes iOS to display a system prompt or hand control to another application, cycling the user between apps. See the Mozilla Security Advisory MFSA-2026-89 and Mozilla Bug Report #1847631 for vendor technical details.

Detection Methods for CVE-2026-86853

Indicators of Compromise

User reports of Firefox for iOS becoming unresponsive with recurring system prompts after visiting a specific URL.
Repeated app-switch events in iOS diagnostics originating from Firefox toward handlers such as tel:, sms:, facetime:, or third-party app schemes.
Web proxy or DNS logs showing sessions to newly registered domains immediately preceding user complaints.

Detection Strategies

Monitor mobile device management (MDM) telemetry for Firefox for iOS versions below 155.1 in the fleet inventory.
Inspect web gateway logs for pages serving JavaScript that assigns external URL schemes to location in tight loops.
Correlate helpdesk tickets describing prompt-flood behavior with the URLs visited immediately prior to the incident.

Monitoring Recommendations

Track Firefox for iOS version distribution across managed devices and alert on installations older than 155.1.
Enable URL categorization and reputation filtering on mobile web traffic to block known malicious domains before page load.
Review user-reported browser hangs on a periodic basis to identify clusters that may indicate active exploitation.

How to Mitigate CVE-2026-86853

Immediate Actions Required

Update Firefox for iOS to version 155.1 or later through the Apple App Store on all managed and personal devices.
Push an MDM compliance policy that flags or blocks devices running vulnerable Firefox for iOS builds.
Advise users to force-close the Firefox tab or the application itself if they encounter repeated system prompts triggered by a webpage.

Patch Information

Mozilla fixed CVE-2026-86853 in Firefox for iOS 155.1. Details are published in the Mozilla Security Advisory MFSA-2026-89, with underlying engineering context in Mozilla Bug Report #1847631. Users should install the update from the App Store; enterprise fleets should enforce the minimum version through MDM.

Workarounds

Instruct users to avoid untrusted links in Firefox for iOS until the update is applied.
Use an alternative browser configured with strict scheme-handler prompts when visiting unknown sites.
Apply web content filtering at the network layer to reduce exposure to malicious webpages targeting mobile browsers.

bash

# Example MDM query to identify vulnerable Firefox for iOS installations
# Replace with your MDM platform's query syntax
mdm-cli query devices \
  --app-bundle-id org.mozilla.ios.Firefox \
  --app-version-less-than 155.1 \
  --output compliance-report.json