CVE-2025-55030
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk4th percentile - higher than 4% of all known CVEs
Summary
Firefox for iOS would not respect a Content-Disposition header of type Attachment and would incorrectly display the content inline rather than downloading, potentially allowing for XSS attacks. This was fixed in Firefox for iOS 142.
Risk Assessment
Users may be exposed to XSS attacks if they click a link to malicious content that should be downloaded but is displayed in the browser.
Recommendation
Update Firefox for iOS to version 142 or later, which includes the fix.
Other vulnerabilities in Firefox for iOS
See all- CVE-2023-49060Critical
In Firefox for iOS, an attacker could access internal pages or data by exfiltrating a security key from ReaderMode via the referrerpolicy attribute. This affects Firefox for iOS versions prior to 120.
- CVE-2026-116632Medium
A malicious web page could insert arbitrary text into the FaceTime call prompt shown by iOS, potentially allowing it to display a phishing message inside system UI. This vulnerability was fixed in Firefox for iOS 156.1.
- CVE-2026-116631Medium
A malicious web page could open a tel link in a window that was showing a different website, causing the phone-call prompt to appear as if that site had requested the call. This vulnerability was fixed in Firefox for iOS 156.1.
- CVE-2026-103418High
Firefox for iOS directly interpolated the page's HTML language attribute into translation JavaScript, allowing attacker-controlled markup to execute code in Firefox's privileged content world and bypass the page's Content Security Policy. This vulnerability was fixed in Firefox for iOS 157.1.
- CVE-2026-103417Medium
Firefox for iOS could autofill saved credentials into a new page if cross-origin navigation occurred while the saved-login UI was open. Autofill was not bound to the originating page or rejected when its origin changed. This vulnerability was fixed in Firefox for iOS 157.1.
- CVE-2026-86853Medium
A malicious webpage could repeatedly trigger external URL schemes, causing system prompts or external application launches. This could make Firefox for iOS temporarily unusable until the page is closed. This vulnerability was fixed in Firefox for iOS 155.1.
- CVE-2026-81267Medium
A malicious webpage could stall a popup's cross-origin navigation after commit, causing the address bar to display the destination origin while continuing to render attacker-controlled content. This vulnerability was fixed in Firefox for iOS 155.0.
- CVE-2026-14906Medium
A vulnerability in Firefox for iOS allowed malicious page titles to overwrite saved PDF files or bundled content within the application sandbox. This issue was fixed in version 152.4.
- CVE-2026-13356Medium
A malicious webpage could interrupt a pending navigation by enqueuing a synchronous JavaScript dialog, causing the browser UI to display the destination origin in the address bar while continuing to render attacker-controlled content. This vulnerability was fixed in Firefox for iOS 152.3.
- CVE-2026-53900Medium
Firefox for iOS preserved cookies set on the initial PDF request across cross-origin HTTP redirects, allowing a malicious site to inject arbitrary cookies into requests to an unrelated target domain.
Original NVD description (English source)
Firefox for iOS would not respect a Content-Disposition header of type Attachment and would incorrectly display the content inline rather than downloading, potentially allowing for XSS attacks. This vulnerability was fixed in Firefox for iOS 142.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS