{"id":"CVE-2026-116631","kind":"vulnerability","aliases":["CVE-2026-116631"],"related":[],"title":"Firefox for iOS: tel links can show a phone-call prompt for the wrong site","description":"A malicious web page could open a tel link in a window that was showing a different website, causing the phone-call prompt to appear as if that site had requested the call. This vulnerability was fixed in Firefox for iOS 156.1.","summary":"A malicious web page could open a tel link in a window showing a different website, so the phone-call prompt appears to come from that other site. An attacker can trick a user into placing a call they did not expect from a site they trust.","severity":"medium","cvss":5.4,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["firefox-ios","ios","mobile","runtime"],"not_affected_if":["firefox-ios-156.1-or-later"],"how_to_check":"- Check the Firefox for iOS version in Settings or the App Store; versions below `156.1` are affected.","fix":"- Update Firefox for iOS to `156.1` or later.","status":"open","published_at":"2026-10-26T19:16:30+00:00","first_seen_at":"2026-10-26T19:32:06+00:00","triaged_at":"2026-10-26T19:34:00+00:00","updated_at":"2026-10-26T19:34:00+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-10-26T19:34:00Z","model":"claude-haiku-5-5","output":{"fix":"- Update Firefox for iOS to `156.1` or later.","reach":"internet","title":"Firefox for iOS: tel links can show a phone-call prompt for the wrong site","impact":"low","summary":"A malicious web page could open a tel link in a window showing a different website, so the phone-call prompt appears to come from that other site. An attacker can trick a user into placing a call they did not expect from a site they trust.","category":"runtime","nicknames":[],"who_cares":["firefox-ios","ios","mobile"],"confidence":0.6,"needs_auth":"no","worst_case":"User is tricked into placing an unexpected phone call","analyst_note":"","how_to_check":"- Check the Firefox for iOS version in Settings or the App Store; versions below `156.1` are affected.","needs_analyst":false,"not_affected_if":["firefox-ios-156.1-or-later"],"who_is_affected":"Users of Firefox for iOS before version 156.1. Browsing on other browsers or on desktop is not described as affected by the sources. Teams that manage iOS devices should push the update through their normal app update channel.","user_interaction":"yes","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000538,"input_tokens":3281,"output_tokens":419,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-116631':19A,22A '-2026':18A,21A '156.1':119C 'appear':51B,102C 'attack':59B 'call':11A,49B,67B,99C,110C 'caus':95C 'come':53B 'could':33B,81C 'cve':17A,20A 'differ':43B,93C 'expect':71B 'firefox':1A,24B,116C 'firefox-io':23B 'fix':114C 'io':3A,25B,26B,118C 'link':5A,37B,85C 'malici':30B,78C 'mobil':27B 'open':34B,82C 'page':32B,80C 'phone':10A,48B,98C 'phone-cal':9A,47B,97C 'place':65B 'prompt':12A,50B,100C 'request':108C 'runtim':28B 'show':7A,41B,91C 'site':16A,57B,74B,106C 'tel':4A,36B,84C 'trick':61B 'trust':76B 'user':63B 'vulner':112C 'web':31B,79C 'websit':44B,94C 'window':40B,88C 'wrong':15A","nicknames":[],"mitigations":[],"who_affected":"Users of Firefox for iOS before version 156.1. Browsing on other browsers or on desktop is not described as affected by the sources. Teams that manage iOS devices should push the update through their normal app update channel.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-26T19:16:30+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L","cvss_by":"134c704f-9b21-4f2e-91b3-4a467353bcc0","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116631","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116631","severity":null,"published_at":"2026-10-26T19:16:30+00:00","modified_at":"2026-10-26T19:16:30+00:00","first_seen_at":"2026-10-26T19:32:06+00:00","fetched_at":"2026-10-26T19:32:06+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}