EUVD-2026-37107
GHSA-cw62-w555-56pp
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Network-reachable web content bypass with no privileges; UI:R because the victim must load attacker-controlled content in Firefox; high C/I from cross-origin data exposure, no availability impact.
Primary rating from Vendor (mozilla).
CVSS VectorVendor: mozilla
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Lifecycle Timeline
3DescriptionCVE.org
Mitigation bypass in the DOM: Security component. This vulnerability was fixed in Firefox 152.
Articles & Coverage 1
AnalysisAI
Security mitigation bypass in the DOM: Security component of Mozilla Firefox prior to version 152 allows remote attackers to compromise confidentiality and integrity of browser-rendered content without user interaction. The flaw carries a critical CVSS 3.1 score of 9.1 (AV:N/AC:L/PR:N/UI:N) and is tagged as an Authentication Bypass class issue, though no public exploit identified at time of analysis. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The victim must run Mozilla Firefox prior to version 152 and load attacker-influenced web content that triggers the bypass in the DOM: Security component. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) describes a remotely exploitable, low-complexity, unauthenticated bypass with high confidentiality and integrity impact but no availability impact - typical of a web content security bypass rather than RCE. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker hosts a malicious web page (or compromises a legitimate site via malvertising) that exploits the DOM: Security mitigation bypass when visited by a pre-152 Firefox user. The bypass enables the attacker to read sensitive data from another origin (e.g., session tokens, banking session content) or modify trusted content in a way that defeats the browser's intended boundary, leading to credential theft or session hijacking. … |
| Remediation | Vendor-released patch: Firefox 152 - upgrade Firefox to version 152 or later as published in Mozilla advisories MFSA2026-57 (https://www.mozilla.org/security/advisories/mfsa2026-57/) and MFSA2026-60 (https://www.mozilla.org/security/advisories/mfsa2026-60/). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Inventory all Firefox installations prior to version 152 across all platforms (desktop, mobile, server). …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More from same product – last 7 days
Unauthenticated remote command execution in rclone's remote control daemon (rcd) affects versions 1.55.0 through 1.74.2
Same-origin policy bypass in the Networking: Cookies component. This vulnerability was fixed in Firefox 152 and Firefox
Security mitigation bypass in the DOM: Security component of Mozilla Firefox allows remote attackers to circumvent brows
Privilege escalation in the WebRender graphics component of Mozilla Firefox enables remote attackers to elevate privileg
Origin validation failure in CyberArk's Idira Identity Browser Extension for Chrome, Firefox, and Edge (versions prior t
Share
External POC / Exploit Code
Leaving vuln.today