{"id":"CVE-2026-121842","published":"2026-11-09T14:17:08.400","lastModified":"2026-11-10T16:27:13.943","description":"Privilege escalation in the Reader View component in Firefox for iOS. This vulnerability was fixed in Firefox for iOS 160.0.","cvssScore":8.8,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cwes":[],"vendors":[],"products":[],"references":[{"url":"https://bugzilla.mozilla.org/show_bug.cgi?id=2076233","tags":[]},{"url":"https://www.mozilla.org/security/advisories/mfsa2026-124/","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"A privilege escalation flaw in Firefox for iOS's Reader View component allowed unprivileged code to gain elevated privileges, potentially enabling full compromise of the app sandbox. This matters because it could let attackers bypass iOS security boundaries and access sensitive user data or execute arbitrary code with app-level permissions.","exploitability":"Exploitation requires user interaction (e.g., visiting a malicious webpage that triggers Reader View) and likely relies on specific internal logic flaws in the component, but low attack complexity suggests it is feasible for an attacker to craft a reliable exploit.","blast_radius":"If exploited, an attacker could escape the app sandbox, exfiltrate local data (e.g., cookies, history, saved credentials), or install persistent malware within the Firefox for iOS environment.","remediation":"Upgrade to Firefox for iOS 160.0 or later, as this version contains the official fix for CVE-2026-121842.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["privilege-escalation","ios","sandbox-escape","browser"],"model":"garnet-coder","analyzedAt":"2026-11-10T09:47:13.918Z"}}