Mozilla pushed Firefox for iOS 151.2 on June 1 to fix two security vulnerabilities in Reader View, both rated high severity.
Reader View is the stripped-down reading mode that removes ads, menus, and images from a webpage and shows you plain text. A lot of people use it without thinking much about it. These bugs lived inside that feature.
The first flaw, tracked as CVE-2026-9308, came down to how Reader View built its HTML template. It was swapping in page content before it finished replacing some internal placeholders. A malicious page could exploit that ordering to inject arbitrary JavaScript.
The second bug, CVE-2026-9309, was a missing HTML escape in Reader View’s handling of JSON-LD metadata, a type of structured data that sites embed in pages. So basically, it had the same result: a crafted page could inject markup and run JavaScript it had no business running.
Mozilla’s advisory describes the impact of both as high. And there’s no mention of either vulnerability being exploited in the wild. So this doesn’t appear to be an emergency situation. Still, the fix is already out.
The Mozilla advisory credits Muneaki Nishimura as the reporter for both CVE-2026-9308 and CVE-2026-9309.
To get the fix, open the App Store, search for Firefox, and install the update if you don’t already have version 151.2. You can also check your current version by going to Firefox Settings > About Firefox.
That said, other than these security fixes, it’s not immediately clear if the update adds any other features. The release notes just mention “behind-the-scenes updates”.
The browser recently gained Chrome-like adaptive URL autofill, but only on desktop for now, with no timeline for mobile support.


