CVE-2026-2790

The vulnerability (CWE-346) consists of improper verification of request origin in the JAR archive handling component in the browser's network layer. An attacker can exploit the error in Same-Origin Policy enforcement to allow a malicious website to access data or resources from a different origin — contrary to the expected domain isolation. The attack requires no authentication, user interaction, or special network conditions, as evidenced by the CVSS vector (AV:N/AC:L/PR:N/UI:N).

An attacker can gain unauthorized access to sensitive data, modify content, or violate the integrity and availability of resources protected by Same-Origin Policy, which may lead to session theft, personal data theft, or other sensitive information disclosure.

Update to Firefox 148 or Firefox ESR 140.8, Thunderbird 148 or Thunderbird 140.8, where the vulnerability has been patched. Patches are available in manufacturer references (mozilla.org/security/advisories).

Mozilla Firefox versions prior to 148 and Firefox ESR versions prior to 140.8, Mozilla Thunderbird versions prior to 148 and Thunderbird ESR versions prior to 140.8