CVE-2026-9078: Firefox for iOS Domain Spoofing Vulnerability

CVE-2026-9078 Overview

CVE-2026-9078 is a user interface spoofing vulnerability in Firefox for iOS. The browser rendered specially crafted right-to-left (RTL) and internationalized domain names (IDNs) incorrectly in link preview UI surfaces. A crafted RTL hostname could visually reorder portions of the displayed domain. Attacker-controlled sites could appear as trusted origins to the user. Mozilla resolved the issue in Firefox for iOS 151.1. The flaw is tracked under [CWE-451] (User Interface Misrepresentation of Critical Information).

Critical Impact

Attackers can spoof trusted domain names in Firefox for iOS link previews, enabling phishing and credential theft against users who rely on the preview UI to verify destinations.

Affected Products

• Mozilla Firefox for iOS prior to version 151.1
• iOS devices running vulnerable Firefox builds
• Users interacting with link preview UI surfaces on affected versions

Discovery Timeline

• 2026-05-25 - CVE-2026-9078 published to NVD
• 2026-05-26 - Last updated in NVD database

Technical Details for CVE-2026-9078

Vulnerability Analysis

The vulnerability resides in how Firefox for iOS renders hostnames inside link preview UI surfaces. When a URL contains right-to-left (RTL) Unicode characters or internationalized domain name (IDN) labels, the browser fails to apply correct bidirectional text handling. The displayed hostname does not match the actual destination authority parsed by the network stack. An attacker can construct a hostname that visually appears as a legitimate domain while resolving to attacker-controlled infrastructure. The vulnerability requires user interaction. Successful exploitation undermines the visual trust signals users rely on before clicking a link.

Root Cause

The root cause is improper bidirectional text rendering and IDN display logic in the link preview component. Firefox for iOS did not enforce display rules sufficient to prevent RTL override characters from reordering visible label segments. The discrepancy between the rendered string and the canonical hostname allows the spoof. Mozilla addressed the issue by correcting the display logic in Firefox for iOS 151.1.

Attack Vector

The attack proceeds over the network and requires user interaction. An attacker registers a domain containing RTL or homoglyph IDN characters and distributes the URL through email, messaging, or web content. When the victim long-presses or hovers to invoke the link preview, the displayed hostname renders as a familiar trusted brand. The user proceeds to the attacker-controlled site believing it is legitimate. Refer to the Mozilla Security Advisory MFSA-2026-52 and Mozilla Bugzilla Report #2029371 for vendor analysis.

Detection Methods for CVE-2026-9078

Indicators of Compromise

• URLs containing Unicode RTL override characters such as U+202E or mixed-script IDN labels resolving to unfamiliar registrars
• DNS queries from iOS devices to punycode (xn--) hostnames that visually mimic corporate or financial brands
• Outbound HTTPS connections from Firefox for iOS to newly registered domains following inbound phishing messages

Detection Strategies

• Inspect web proxy and DNS logs for punycode hostnames and decode them to identify visually deceptive labels
• Correlate user reports of suspicious link previews with browser version telemetry to identify unpatched Firefox for iOS clients
• Apply email gateway rules that flag URLs containing bidirectional control characters or mixed Unicode scripts

Monitoring Recommendations

• Track Firefox for iOS version distribution across managed mobile devices and alert on versions below 151.1
• Monitor authentication telemetry for credential submissions from iOS user agents to recently registered domains
• Enable DNS filtering services that block known homoglyph and IDN spoofing domains

How to Mitigate CVE-2026-9078

Immediate Actions Required

• Update Firefox for iOS to version 151.1 or later through the Apple App Store on all managed and personal devices
• Communicate the spoofing risk to users and instruct them to verify destinations by tapping into the address bar rather than trusting previews
• Enforce mobile device management (MDM) policies that require current browser versions before granting access to corporate resources

Patch Information

Mozilla fixed CVE-2026-9078 in Firefox for iOS 151.1. The vendor advisory is published as Mozilla Security Advisory MFSA-2026-52, and the upstream bug tracking entry is available at Mozilla Bugzilla Report #2029371. Apply the App Store update to remediate affected devices.

Workarounds

• Direct users to navigate to sensitive sites by typing the URL or using bookmarks instead of clicking links
• Use an alternate browser on iOS until Firefox for iOS 151.1 is installed
• Deploy enterprise DNS or secure web gateway filtering that blocks suspicious IDN and punycode domains

# Configuration example: query installed Firefox for iOS version via MDM inventory
# Replace <device-id> with target identifier in your MDM platform
mdmctl query --device <device-id> --app org.mozilla.ios.Firefox --field CFBundleShortVersionString