CVE-2026-4700

The vulnerability classified as CWE-288 indicates a bypass of authentication mechanism or access control via an alternative path or channel in the HTTP protocol handling component. A remote, unauthenticated attacker can bypass existing network security measures implemented in the HTTP layer of the browser or email client. A network attack vector (AV:N) with no privilege requirements (PR:N) and user interaction (UI:N) means the exploit can be conducted entirely remotely and automatically.

Successful exploitation of the vulnerability may give an attacker full control over the targeted system, resulting in disclosure of confidential data, modification of resources, and disruption of service availability (high indicators C:H/I:H/A:H in CVSS).

Immediately update to Firefox 149, Firefox ESR 140.9, Thunderbird 149, or Thunderbird 140.9, in which the vulnerability has been fixed. Patches are available on the official manufacturer's websites and described in Mozilla security advisories (MFSA2026-20, MFSA2026-22, MFSA2026-23, MFSA2026-24).

Mozilla Firefox versions before 149, Mozilla Firefox ESR versions before 140.9, Mozilla Thunderbird versions before 149, and Mozilla Thunderbird ESR versions before 140.9.