What is CVE-2026-86853?

CVE-2026-86853 is a medium-severity vulnerability in Mozilla Firefox Mobile, classified under User Interface (UI) Misrepresentation of Critical Information. CVSS score: 4.3/10. Published 2026-09-08.

How severe is CVE-2026-86853?

Medium severity. CVSS v3 base score is 4.3 out of 10.

Vulnerability in Mozilla Firefox Mobile

CVE-2026-86853

A malicious webpage could repeatedly trigger external URL schemes, causing system prompts or external application launches. This could make Firefox for iOS temporarily unusable until the page is closed. This vulnerability was fixed in Firefox for iOS 155.1.

Published 2026-09-08 · last modified 2026-10-05.

CVSS v3 metric

CVSS v3 base score 4.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L.

EPSS exploit prediction

EPSS: 0.003 (19.2th percentile), scored 2026-10-24.

Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 19th percentile — 19.2% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS over last 30 days · oldest: 0.003 · newest: 0.003 · change: -0.000

Affected products

Mozilla Firefox Mobile

Weakness classification (CWE)

CWE-451 — User Interface (UI) Misrepresentation of Critical Information

References

bugzilla.mozilla.org/show_bug.cgi (Permissions Required)
www.mozilla.org/security/advisories/mfsa2026-89/ (Vendor Advisory)

Frequently asked questions

What is CVE-2026-86853?: CVE-2026-86853 is a medium-severity vulnerability in Mozilla Firefox Mobile, classified under User Interface (UI) Misrepresentation of Critical Information. CVSS score: 4.3/10. Published 2026-09-08.
How severe is CVE-2026-86853?: Medium severity. CVSS v3 base score is 4.3 out of 10.