CVE-2026-13356: A malicious webpage could interrupt a pending navigation by enqueuing a synchronous JavaScript dialog, causing the browser UI to display the destination origin in the address bar w

mediumCVSS 6.3CVE-2026-13356

A malicious webpage could interrupt a pending navigation by enqueuing a synchronous JavaScript dialog, causing the browser UI to display the destination origin in the address bar while continuing to render attacker-controlled content. This vulnerability was fixed in Firefox for iOS 152.3.

Details

Source: NVD Recent CVEs (US · database · site)
Severity: medium — CVSS 6.3
Published: 2026-07-07
Last updated: 2026-07-08
Exploitation: Not in CISA KEV at last sync

Original advisory: https://nvd.nist.gov/vuln/detail/CVE-2026-13356

Exploitation outlook

EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.

Low exploitation riskCVE-2026-133560.13% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 3% of all scored CVEs.

Referenced CVEs

CVE	CSIRTS overview	External
CVE-2026-13356	coverage & exploitation status	NVD · CVE.org

Same CVEs, other sources

How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.

medium[NEW] [medium] Mozilla Firefox for iOS: Vulnerability allows display of false informationcert-bund
unknownVulnerability in Mozilla Firefox for iOS (July 7, 2026)cert-fr-avis

Recent advisories for A malicious webpage

A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.

unknownCVE-2026-5923: Malicious use of a stolen cookie might allow modifications to the contents of the IP phone’s we…nvd · 2026-07-08
unknownCVE-2026-5922: The IP phone might use malicious input stored in configuration parameters and render it as cont…nvd · 2026-07-08