{"id":"CVE-2026-116632","kind":"vulnerability","aliases":["CVE-2026-116632"],"related":[],"title":"Firefox for iOS: web page injects text into FaceTime call prompt","description":"A malicious web page could insert arbitrary text into the FaceTime call prompt shown by iOS, potentialy allowing it to display a phishing message inside system UI. This vulnerability was fixed in Firefox for iOS 156.1.","summary":"A malicious web page could insert arbitrary text into the FaceTime call prompt that iOS shows, letting it display a phishing message inside system UI. The issue was fixed in Firefox for iOS 156.1.","severity":"medium","cvss":5.4,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["end-users","firefox","ios","mobile","other"],"not_affected_if":["firefox-not-installed","updated-to-156.1"],"how_to_check":"- Check the installed Firefox for iOS version in Settings > Firefox > About, or the App Store update list.\n- unknown for other products; the sources do not say.","fix":"- Update Firefox for iOS to `156.1` or later.","status":"open","published_at":"2026-10-26T19:16:30+00:00","first_seen_at":"2026-10-26T19:32:06+00:00","triaged_at":"2026-10-26T19:33:57+00:00","updated_at":"2026-10-26T19:33:57+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-10-26T19:33:57Z","model":"claude-haiku-5-5","output":{"fix":"- Update Firefox for iOS to `156.1` or later.","reach":"internet","title":"Firefox for iOS: web page injects text into FaceTime call prompt","impact":"low","summary":"A malicious web page could insert arbitrary text into the FaceTime call prompt that iOS shows, letting it display a phishing message inside system UI. The issue was fixed in Firefox for iOS 156.1.","category":"other","nicknames":[],"who_cares":["firefox","ios","mobile","end-users"],"confidence":0.6,"needs_auth":"no","worst_case":"Phishing text shown inside iOS system call UI","analyst_note":"","how_to_check":"- Check the installed Firefox for iOS version in Settings > Firefox > About, or the App Store update list.\n- unknown for other products; the sources do not say.","needs_analyst":false,"not_affected_if":["firefox-not-installed","updated-to-156.1"],"who_is_affected":"Users of Firefox for iOS older than `156.1` who open untrusted web pages on iPhone or iPad. Teams that do not ship or use Firefox for iOS on managed devices have no exposure from this entry. The sources do not describe server-side impact.","user_interaction":"yes","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000557,"input_tokens":3300,"output_tokens":453,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-116632':14A,17A '-2026':13A,16A '156.1':57B,93C 'allow':75C 'arbitrari':30B,64C 'call':10A,35B,69C 'could':28B,62C 'cve':12A,15A 'display':42B,78C 'end':19B 'end-us':18B 'facetim':9A,34B,68C 'firefox':1A,21B,54B,90C 'fix':52B,88C 'inject':6A 'insert':29B,63C 'insid':46B,82C 'io':3A,22B,38B,56B,73C,92C 'issu':50B 'let':40B 'malici':25B,59C 'messag':45B,81C 'mobil':23B 'page':5A,27B,61C 'phish':44B,80C 'potentiali':74C 'prompt':11A,36B,70C 'show':39B 'shown':71C 'system':47B,83C 'text':7A,31B,65C 'ui':48B,84C 'user':20B 'vulner':86C 'web':4A,26B,60C","nicknames":[],"mitigations":[],"who_affected":"Users of Firefox for iOS older than `156.1` who open untrusted web pages on iPhone or iPad. Teams that do not ship or use Firefox for iOS on managed devices have no exposure from this entry. The sources do not describe server-side impact.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-26T19:16:30+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L","cvss_by":"134c704f-9b21-4f2e-91b3-4a467353bcc0","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116632","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116632","severity":null,"published_at":"2026-10-26T19:16:30+00:00","modified_at":"2026-10-26T19:16:30+00:00","first_seen_at":"2026-10-26T19:32:06+00:00","fetched_at":"2026-10-26T19:32:06+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}