CVE-2026-103417

Executive Summary

CVE-2026-103417 is a cross-origin credential disclosure vulnerability in Firefox for iOS. If a cross-origin navigation occurs while the saved-login autofill UI is open, the browser may autofill saved credentials into the new, non-originating page because the autofill action was not bound to the originating page nor invalidated when the page origin changed. The issue affects Firefox for iOS users with saved credentials who are guided into navigating to an attacker-controlled or unintended origin while the autofill prompt is active, and it was fixed in Firefox for iOS 157.1.

Technical Analysis

The vulnerability class is a cross-origin state/authorization binding failure (weak origin binding of a security-sensitive UI action), consistent with CWE-346 (Origin Validation Error). Per the NVD description, the saved-login UI is presented in the browser on iOS, and the credential injection action ("autofill") is not tied to the page that originally triggered the UI. When the page's origin changes — via cross-origin navigation — during the window in which the saved-login UI is open, the autofill proceeds and the saved credentials can be placed into the newly loaded page.

Two distinct binding failures are described: (1) the autofill is not bound to the originating page, and (2) the autofill is not rejected when the origin changes. This effectively means the browser's credential manager treats the login form context as equivalent across origins, enabling a credential leak into an unexpected origin. Notably, there is no mention of remote code execution, memory corruption, or sandbox escape; the described mechanism is a logic/UI state-binding flaw in the credential-handling flow.

Attack surface: the mobile browser UI's saved-credentials autofill feature. Trigger conditions involve user interaction (the saved-login UI must be open) and a navigation event that changes the origin before the autofill completes. Because this is an interaction-dependent UI flow, exploitation requires some form of cross-origin navigation control by a remote party (e.g., redirect, meta-refresh-equivalent navigation, or link navigation) while the saved-login UI is open.

Specific code paths, function or class names, DOM interfaces, and internal APIs are not provided in the NVD description or CNA title. Therefore, no code-level symbols are asserted here beyond the conceptual entities named in the description: "saved-login UI," "autofill," "cross-origin navigation," and "origin."

Exploitation Scenarios

Because no public PoC or exploit code is available, the following chain is described at the vulnerability-class level and is inferred solely from the NVD description and the data provided. No specific function names, endpoints, or parameters are asserted.

1. Reconnaissance / target identification: An attacker identifies victims who use Firefox for iOS with saved logins and who can be induced to interact with attacker-controlled content (e.g., via a malicious page, link, or advertisement) opened in Firefox for iOS.

2. Triggering the flaw class: The victim is induced to open a page (the originating page) that causes the browser to present the saved-login UI. While that UI remains open, the attacker causes or induces a cross-origin navigation — a navigation to a different origin than the one that produced the saved-login UI — so that the origin of the active page changes while the autofill state is still pending/presented.

3. Payload / execution method (class-level): The cross-origin navigation itself is the "payload" action. Since the autofill is neither bound to the originating page nor rejected on origin change, the browser proceeds to autofill the saved credentials into the new (non-originating) page. From there, the attacker-controlled page can read the credentials if they are injected into a form/context under the attacker's control, or otherwise capture them.

4. Post-exploitation impact: Disclosure of saved credentials to an unintended origin. This yields a valid-account access primitive (MITRE ATT&CK T1078 — Valid Accounts) against whatever service the credentials belong to. Depending on credential reuse, the blast radius may extend beyond a single site. No privilege escalation within the browser process, code execution, or persistence is described.

Constraints and uncertainty: Exploitation is interaction-dependent (the saved-login UI must be open and a cross-origin navigation must occur before/while autofill completes), which is reflected in the elevated Attack Complexity and required User Interaction in the assessed vector. Preconditions such as user gesture requirements, exact timing windows, and whether the navigation must be window-level versus subframe-level are not specified in the provided description and are therefore not asserted.

Impact Assessment

Primary impact: confidentiality loss (credential disclosure). The described flaw does not indicate integrity or availability impact to the browser itself; the harm is to the secrecy of the user's saved credentials and, downstream, to the security of the accounts those credentials protect. Through the ATT&CK T1078 lens, harvested credentials constitute valid-account material usable for unauthorized access.

The assessed vector CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N encodes: network attack vector, high attack complexity, no privileges required, user interaction required, unchanged scope, high confidentiality impact, and no integrity or availability impact. The "high complexity" and "user interaction required" components reflect the fact that the attacker must arrange both the saved-login UI being open and a cross-origin navigation to occur in the appropriate sequence. No official CVSS score was provided; treat the vector as an analytical assessment, not a vendor-published metric.

Blast radius: limited to Firefox for iOS users with saved credentials who are successfully induced into the described interaction sequence. Because credentials are the target, the effective blast radius is determined by credential reuse across services: a single disclosed credential can enable account takeover of the corresponding service, and reused passwords can widen the impact. There is no evidence in the provided data of wormability, mass exploitation, or supply-chain implications.

Detection Guidance

Sigma Rule

title: Cross-Origin Saved-Login Autofill Anomaly - Firefox for iOS (CVE-2026-103417)
id: 8f4c1a2e-3b7d-4c9e-9a11-6d0f2b5c7e10
status: experimental
description: Detects indications that saved-login autofill was associated with a page whose origin changed, consistent with CVE-2026-103417 behavior in Firefox for iOS.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-103417
author: valtersit.com
date: 2026/01/01
logsource:
  product: browser
  service: firefox_ios
detection:
  selection_autofill:
    event.action|contains:
      - 'autofill'
      - 'password_fill'
  selection_origin:
    event.category: 'credential'
    origin.changed: true
  condition: selection_autofill and selection_origin
falsepositives:
  - Legitimate autofill after same-origin navigations if origin.changed is imprecise
level: medium
tags:
  - attack.t1078
  - cve.2026.103417

YARA Rule

rule CVE_2026_103417_Firefox_iOS_Autofill_OriginBypass
{
    meta:
        description = "Heuristic detection for Firefox for iOS saved-login autofill cross-origin navigation weakness (CVE-2026-103417). Client-side artifact hunting; no public PoC."
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-103417"
        date = "2026-01-01"
        severity = "medium"

    strings:
        $a1 = "autofill" ascii nocase
        $a2 = "saved-login" ascii nocase
        $a3 = "savedLogin" ascii
        $a4 = "credential" ascii nocase
        $b1 = "origin" ascii nocase
        $b2 = "crossOrigin" ascii
        $b3 = "originChanged" ascii
        $c1 = "new page" ascii nocase

    condition:
        (2 of ($a*)) and (1 of ($b*))
}

Note: This is a generic artifact-hunting rule only; no unique file/memory signature for CVE-2026-103417 is available in the provided data, and YARA cannot reliably fingerprint this UI-logic flaw. Deploy with high false-positive expectations.

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-103417 Possible Cross-Origin Navigation During Firefox iOS Saved-Login Autofill"; flow:to_client,established; http.header_names; content:"|0d 0a|Location|0d 0a|"; http.response_line; content:"302"; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-103417; classtype:attempted-recon; sid:2026103417; rev:1; metadata:created_at 2026_01_01, updated_at 2026_01_01, cve CVE_2026_103417;)

Note: This rule is a coarse network-side heuristic. The flaw is entirely client-side (Firefox for iOS UI/credential-manager logic); no network signature can reliably detect it. This rule only flags redirect-based navigation patterns that may accompany the attack and will be noisy.

Elastic Detection

process where process.name : ("Firefox" or "firefox") and
  event.action : ("credential_autofill" or "password_fill") and
  not process.parent.name : ("SpringBoard" or "MobileSafari")

Note: Treat as a placeholder telemetry query. Reliable detection requires mobile browser credential-manager telemetry (autofill events correlated with page origin) that is generally not available via standard EDR on iOS.

Splunk SPL Query

index=browser_logs OR index=mobile_security
sourcetype=firefox_ios:security_event
(action="autofill" OR action="password_fill" OR action="credential_fill")
NOT (origin_from=origin_to)
| stats count min(_time) as first_seen max(_time) as last_seen
        values(origin_from) as source_origin values(origin_to) as destination_origin
        by user, device_id, dest_host
| where count > 0
| sort - count

Wazuh OSSEC Rule

<group name="firefox_ios,cve_2026_103417,">
  <rule id="103417" level="7">
    <decoded_as>json</decoded_as>
    <field name="event.action">autofill|password_fill|credential_fill</field>
    <field name="origin.changed" type="pcre2">true</field>
    <description>CVE-2026-103417: Firefox for iOS saved-login autofill associated with a changed page origin</description>
    <mitre>
      <id>T1078</id>
    </mitre>
    <group>credential_access,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

Important context: the NVD description states the vulnerability "was fixed in Firefox for iOS 157.1." This is a vendor-stated fix version derived from the CVE description. However, no patch source, advisory URL, or commit reference is present in the tracked data provided, so patch confidence is recorded as 0/4 per the supplied metadata. For deployment planning, Firefox for iOS 157.1 should be treated as the intended fixed release, and organizations should verify against Mozilla's official release channels before declaring remediation complete.

1. Immediate mitigations

• Upgrade all Firefox for iOS installations to Firefox for iOS 157.1 or later if that build is available from Apple's App Store. Until verified availability, treat affected devices as unpatched for this issue.
• Reduce exposure in the interim: limit or disable saved-login/autofill for high-value credentials, and encourage users to rely on a dedicated password manager whose autofill is origin-bound rather than the browser's built-in saved-login flow.
• User-behavior controls: advise users against navigating away from a login page (e.g., via links, redirects, or ads) while the saved-login/autofill prompt is active, and to dismiss the saved-login UI before following any cross-site navigation.
• Where MDM is available, enforce application update policies for Firefox for iOS so that affected devices are moved to 157.1+ as soon as practicable.

2. Patch/upgrade steps

• Confirm the currently installed Firefox for iOS version on managed devices.
• Deploy Firefox for iOS 157.1 (or later) via the App Store or managed app distribution, and verify the version post-update.
• Because patch confidence is 0/4 in the tracked data, validate the fix against Mozilla's official security advisories/release notes for Firefox for iOS 157.1 before closing any remediation tickets.

3. Long-term hardening

• Standardize on credential managers that bind autofill strictly to the originating origin and reject autofill when the origin changes; avoid credential reuse across sites.
• Enable MFA on accounts whose credentials may be stored in browsers, to reduce the impact of any credential disclosure.
• Include mobile browsers in patch-management and vulnerability-remediation SLAs, since browser credential-path logic on mobile is frequently missed by desktop-centric programs.
• Monitoring: implement the detection content above (with the noted limitations) or equivalent mobile-credential telemetry, and track CVE-2026-103417 for vendor advisory confirmation matching the 157.1 fix statement.

References

• NVD — CVE-2026-103417: https://nvd.nist.gov/vuln/detail/CVE-2026-103417
• Mozilla Security Advisories (Firefox for iOS): https://www.mozilla.org/en-US/security/advisories/ (verify the specific advisory for Firefox for iOS 157.1)
• Firefox for iOS release notes: https://www.mozilla.org/en-US/firefox/ios/notes/ (verify 157.1 release)
• FIRST EPSS: https://www.first.org/epss/ (CVE-2026-103417 is not yet scored by FIRST.org at time of writing)
• CISA KEV catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog (CVE-2026-103417 is NOT listed in KEV per provided data)

Threat actor and exploit status: No public PoC, no Nuclei template, and no exploit code are available per the provided data. There is no evidence of exploitation in the wild and no named threat actor campaign associated with CVE-2026-103417. All exploitation analysis above is inferred from the vulnerability class and the NVD description; it is not based on observed public exploitation.