Mozilla patches three Firefox for iOS flaws, including two privilege escalations, in version 160.0
Mozilla published security advisory mfsa2026-124 on 9 November 2026 covering three CVEs in Firefox for iOS, all fixed in version 160.0 (mozilla.org). Mozilla rates CVE-2026-121842 (privilege escalation in the Reader View component, reported by navapon) and CVE-2026-121843 (privilege escalation, reported by Hoang Quan) as high impact. It rates CVE-2026-121841 (an "other issue", reported by Hoang Quan and tu3n.4nh) as moderate. The article reports the impact as unspecified by the vendor, which conflicts with Mozilla's own ratings, and the vendor's word prevails. Mozilla's advisory gives no CVSS score, no exploitation status and no prerequisites, and no fix pull request was opened for this report.
Entenda a falha
A vulnerabilidade
Mozilla's advisory mfsa2026-124 covers three flaws in Firefox for iOS, all fixed in 160.0; versions before 160.0 are affected. CVE-2026-121842 is a privilege escalation in the Reader View component, and CVE-2026-121843 is another privilege escalation. Mozilla rates both as high impact. CVE-2026-121841 is an unspecified "other issue" rated moderate. The advisory gives no CVSS score, no prerequisites (network reach, authentication, user interaction) and no exploitation status. CERT-FR lists the impact as "unspecified by the vendor", but Mozilla's own ratings prevail.
Como funciona
The articles do not describe how the vulnerable code works or at which step it fails. They only say that two of the flaws allow privilege escalation, one of them in Reader View, and that the third is an unspecified issue. Any more detail would be a guess.
Por que é vulnerável
The root cause is not stated for any of the three CVEs. The advisory and the CVE records give no CWE, and no fix pull request was opened for this report. The only known fix is shipping Firefox for iOS 160.0.
Onde está
Only CVE-2026-121842 is placed in a component, Reader View. Mozilla's Bugzilla entries are 2076233 (CVE-2026-121842), 2083030 (CVE-2026-121843) and 2081874 (CVE-2026-121841). No files or functions are named.
Como foi descoberta
Mozilla credits external reporters: navapon for CVE-2026-121842, Hoang Quan for CVE-2026-121843, and Hoang Quan together with tu3n.4nh for CVE-2026-121841. The articles do not say how they found the flaws. Mozilla published the advisory on 9 November 2026 and CERT-FR issued its notice on 10 November. Neither source reports exploitation in the wild.
Explicação gerada por IA a partir da matéria e dos artigos, em 10/11/2026 13:43.
Detalhes técnicos
Mozilla's advisory ties the three CVEs to Bugzilla entries 2076233 (CVE-2026-121842), 2083030 (CVE-2026-121843) and 2081874 (CVE-2026-121841) (mozilla.org). The CVE records for CVE-2026-121841 name Mozilla as CNA and state that the flaw was fixed in Firefox for iOS 160.0 (app.opencve.io). Neither source states whether the flaws are exploited in the wild, and no CWE or CVSS vector is given for the three CVEs.
Remediação
Update Firefox for iOS to version 160.0 or later, which is the release the advisory names as carrying all three fixes (mozilla.org). The advisory covers only the iOS build, so desktop Firefox is not in its scope.
Relatos divergentes
The article labels the impact as unspecified by the vendor (cert.cyber.gouv.fr). Mozilla's advisory rates two bugs high and one moderate (mozilla.org), and that vendor rating is used in this record.
Linha do tempo
-
Mozilla patches three Firefox for iOS flaws, including two privilege escalations, in version 160.0
ler a análise desta fonte ocultar
Mozilla published security advisory mfsa2026-124 on 9 November 2026 covering three CVEs in Firefox for iOS, all fixed in version 160.0 (mozilla.org). Mozilla rates CVE-2026-121842 (privilege escalation in the Reader View component, reported by navapon) and CVE-2026-121843 (privilege escalation, reported by Hoang Quan) as high impact. It rates CVE-2026-121841 (an "other issue", reported by Hoang Quan and tu3n.4nh) as moderate. The article reports the impact as unspecified by the vendor, which conflicts with Mozilla's own ratings, and the vendor's word prevails. Mozilla's advisory gives no CVSS score, no exploitation status and no prerequisites, and no fix pull request was opened for this report.
Technical Details
Mozilla's advisory ties the three CVEs to Bugzilla entries 2076233 (CVE-2026-121842), 2083030 (CVE-2026-121843) and 2081874 (CVE-2026-121841) (mozilla.org). The CVE records for CVE-2026-121841 name Mozilla as CNA and state that the flaw was fixed in Firefox for iOS 160.0 (app.opencve.io). Neither source states whether the flaws are exploited in the wild, and no CWE or CVSS vector is given for the three CVEs.
Remediation
Update Firefox for iOS to version 160.0 or later, which is the release the advisory names as carrying all three fixes (mozilla.org). The advisory covers only the iOS build, so desktop Firefox is not in its scope.
Conflicting Reports
The article labels the impact as unspecified by the vendor (cert.cyber.gouv.fr). Mozilla's advisory rates two bugs high and one moderate (mozilla.org), and that vendor rating is used in this record.