Live › vulnerability › CVE-2026-116631
Go to dashboardA malicious web page could open a tel link in a window showing a different website, so the phone-call prompt appears to come from that other site. An attacker can trick a user into placing a call they did not expect from a site they trust.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-26 19:32 UTC. All times on this page are UTC.
Users of Firefox for iOS before version 156.1. Browsing on other browsers or on desktop is not described as affected by the sources. Teams that manage iOS devices should push the update through their normal app update channel.
No product ranges from the sources yet.
156.1 are affected.156.1 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A malicious web page could open a tel link in a window that was showing a different website, causing the phone-call prompt to appear as if that site had requested the call. This vulnerability was fixed in Firefox for iOS 156.1.
This page as .md · .json · in your agent: get_signal("CVE-2026-116631")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.