CVE-2026-8948

The bug consists of improper implementation of the same-origin policy mechanism in the networking component within the DOM model. The same-origin policy is the foundation of browser security — its bypass means that a malicious website can perform requests and read responses from other origins, to which it normally should not have access. The vulnerability is remotely accessible, without authentication and without user interaction, which significantly lowers the threshold for its exploitation.

An attacker can obtain unauthorized access to sensitive data belonging to other origins (e.g., session cookies, form data, API responses) and modify data in the context of other websites — with the CVSS vector indicating high impact on confidentiality and integrity, with no impact on availability.

Mozilla Firefox should be immediately updated to version 151 or later and Mozilla Thunderbird to version 151 or later. Fixes have been described in Mozilla security bulletins: mfsa2026-46 (Firefox) and mfsa2026-50 (Thunderbird).

Mozilla Firefox in versions prior to 151 and Mozilla Thunderbird in versions prior to 151.