Skip to main content

Mozilla Firefox CVE-2026-74960

| EUVDEUVD-2026-60659 HIGH
Improper Access Control (CWE-284)
2026-08-18 mozilla GHSA-5r7x-fg3w-vcg2
Authentication Bypass Mozilla
8.1
CVSS 3.1 · Vendor: mozilla
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Attacker hosts malicious webpage
  2. Delivery
    Victim navigates to page in unpatched Firefox
  3. Exploit
    WebExtensions site isolation boundary bypassed
  4. Execution
    Cross-origin data from other tabs read or modified
  5. Impact
    Sensitive data (session tokens, page content) exfiltrated to attacker

Vulnerability Assessment

Weakness
CWE
CWE-284
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK

1 technique across 1 tactic: Defense Evasion

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Exploitation Conditions

Exploitation requires a user running Firefox prior to version 154 (or ESR prior to 140.14 / 153.1) to visit an attacker-controlled or malicious webpage - confirmed by the CVSS UI:R metric. No authentication or privileges are required from the attacker side (PR:N). The vulnerability resides specifically in the WebExtensions component; whether exploitation also requires a malicious or compromised browser extension to be installed, or whether any extension state is sufficient, is not explicitly stated in the available description - this is a key unknown that defenders should clarify by reviewing the Bugzilla report at https://bugzilla.mozilla.org/show_bug.cgi?id=2049148. Exploitation is bounded by the need for user navigation to a crafted page and by the patch being available and widely auto-distributed by Mozilla.
Impact

The CVSS 8.1 score is driven by high C and I impact with no privilege requirement and low attack complexity, but the mandatory user interaction (UI:R) and absence of scope change (S:U) meaningfully constrain real-world risk. EPSS at 0.16% (5th percentile) is strikingly low relative to the CVSS severity, which is consistent with the UI:R constraint and the absence of any public exploit code or CISA KEV listing. The gap between CVSS severity and EPSS exploitation probability suggests this is not currently being mass-exploited. However, browser vulnerabilities with cross-origin data access capability are attractive targets for espionage and credential theft, and the low EPSS may change rapidly if a working exploit surfaces. No public exploit identified at time of analysis, and the flaw is not confirmed actively exploited. Organizations running unpatched Firefox on enterprise endpoints where users browse untrusted content should treat patching as high priority given the impact class, even if the current exploitation signal is low.
Exploit ScenarioDerived

An attacker hosts a crafted webpage designed to trigger the site isolation flaw in Firefox's WebExtensions component. When a user running an unpatched Firefox version visits the page, the attacker's code exploits the access control gap to read or modify data belonging to other loaded origins - such as session tokens, page content, or form data from banking or enterprise applications open in adjacent tabs. No public exploit code has been identified at time of analysis.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Aug 21, 2026

Site isolation is broken in Firefox's WebExtensions component, allowing cross-origin access control boundaries to be violated. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N) places this as network-exploitable with high confidentiality and integrity impact, requiring only that a user visit an attacker-controlled page. Vendor-released patches are confirmed across all active Firefox release channels; no public exploit has been identified at time of analysis and EPSS at 0.16% (5th percentile) reflects low current exploitation probability.

RemediationAI

Upgrade to Firefox 154 or later, Firefox ESR 140.14 or later, or Firefox ESR 153.1 or later, as confirmed by Mozilla across advisories mfsa2026-74 through mfsa2026-80 (https://www.mozilla.org/security/advisories/mfsa2026-74/). Firefox's built-in auto-update mechanism should apply this automatically on most desktop installations. For enterprise environments managing Firefox via policy, push the ESR update through your software deployment tooling as a priority patch. If patching is immediately blocked, restricting which browser extensions are permitted via Enterprise Policy (ExtensionSettings policy, managed extensions allowlist) reduces the attack surface of the WebExtensions component, though this may disrupt productivity tooling. Completely disabling extension support (DisableExtensions policy) eliminates the vulnerable component entirely but removes all extension functionality. There is no indication of a workaround that preserves full browser functionality without patching.

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

Site isolation is a browser security architecture that enforces process-level separation between web origins, preventing cross-site data leakage between tabs and frames. The WebExtensions subsystem provides the API surface through which browser extensions interact with web content and has elevated cross-origin visibility compared to ordinary page scripts. CWE-284 (Improper Access Control) identifies the root cause class: the access control logic enforcing origin separation within the WebExtensions component did not correctly gate cross-origin operations. CPE string cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:* confirms the vulnerability spans all Firefox platforms and architectures. The breadth of Mozilla advisories (mfsa2026-74 through mfsa2026-80) suggests the fix touched multiple release trains, consistent with a systemic WebExtensions API boundary flaw rather than an isolated code path.

Know when Mozilla gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (mozilla) PRIMARY 8.1 HIGH
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
vuln.today AI 9.3 CRITICAL

Site isolation bypass inherently crosses origin boundaries (S:C); UI:R and PR:N confirmed by network delivery requiring user page visit with no credential requirement.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N
SUSE HIGH
Red Hat 6.1 MEDIUM

Primary rating from Vendor (mozilla).

CVSS VectorVendor: mozilla

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
None

Lifecycle Timeline

3
CVSS changed
Aug 21, 2026 - 20:22 NVD
8.1 (HIGH)
CVE Published
Aug 18, 2026 - 12:23 cve.org
UNKNOWN (no severity yet)
CVE Published
Aug 18, 2026 - 12:23 cve.org
HIGH 8.1

DescriptionCVE.org

Site isolation issue in the WebExtensions component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, and Firefox ESR 153.1.

Executive ViewAI

Why It Matters

Firefox WebExtensions site isolation bypass (CVE-2026-74960) enables attackers to steal user data and modify web content when employees visit malicious pages, creating immediate risk of credential theft and session compromise. Urgent patching of all Firefox instances is required to prevent exploitation.

Business Impact: High
Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

EPSS Score
0.2%
Top 95% exploitable
Prevalence
Ubiquitous
Firefox is one of the most widely deployed desktop browsers globally
Data Quality
6 sources
Confidence: High
EUVD 🇯🇵JVN NVD CVE.org EPSS Vendor VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.2%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Scheduled
Exploitation· derived
None
System Exposure· derived
Open
Automatable· derived
No
Human Impact
High

Priority Score

40
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +40
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Authentication Bypass CRITICAL

Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.

Affected Products (CPE)CVE.org

cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*

More in Mozilla

View all
CVE-2015-4495 HIGH POC
8.8 Aug 08

The PDF reader in Mozilla Firefox before 39.0.3, Firefox ESR 38.x before 38.1.1, and Firefox OS before 2.2 allows remote
CVE-2013-1690 HIGH POC
8.8 Jun 26

Mozilla Firefox before 22.0, Firefox ESR 17.x before 17.0.7, Thunderbird before 17.0.7, and Thunderbird ESR 17.x before

CVE-2013-0758 CRITICAL POC
9.3 Jan 13

Mozilla Firefox before 18.0, Firefox ESR 10.x before 10.0.12 and 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderb
CVE-2013-0753 CRITICAL POC
9.3 Jan 13

Use-after-free vulnerability in the serializeToStream implementation in the XMLSerializer component in Mozilla Firefox b
CVE-2012-3993 CRITICAL POC
9.3 Oct 10

The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbi
CVE-2013-1710 CRITICAL POC
10.0 Aug 07

The crypto.generateCRMFRequest function in Mozilla Firefox before 23.0, Firefox ESR 17.x before 17.0.8, Thunderbird befo
CVE-2017-3823 HIGH POC
8.8 Feb 01

An issue was discovered in the Cisco WebEx Extension before 1.0.7 on Google Chrome, the ActiveTouch General Plugin Conta
CVE-2014-8636 HIGH POC
7.5 Jan 14

The XrayWrapper implementation in Mozilla Firefox before 35.0 and SeaMonkey before 2.32 does not properly interact with

CVE-2013-0757 CRITICAL POC
9.3 Jan 13

The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 18.0, Firefox ESR 17.x before 17.0.2, Thunderbi
CVE-2014-1510 CRITICAL POC
9.8 Mar 19

The Web IDL implementation in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and Se
CVE-2014-1511 CRITICAL POC
9.8 Mar 19

Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and SeaMonkey before 2.25 allow remo
CVE-2013-0643 HIGH
8.8 Feb 27

The Firefox sandbox in Adobe Flash Player before 10.3.183.67 and 11.x before 11.6.602.171 on Windows and Mac OS X, and b

Same weakness CWE-284 – Improper Access Control

View all
CVE-2015-3306 CRITICAL POC
10.0
CVE-2012-4681 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2012-1723 CRITICAL POC
9.8
CVE-2012-5076 CRITICAL POC
9.8
CVE-2014-3120 HIGH POC
8.1
CVE-2013-2423 LOW POC
3.7
CVE-2016-3427 CRITICAL
9.8

Same technique Authentication Bypass

View all
CVE-2023-22515 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2022-40684 CRITICAL POC
9.8
CVE-2025-61882 CRITICAL POC
9.8
CVE-2024-0012 CRITICAL POC
9.3

Vendor StatusVendor

SUSE

Severity: Important
Product Status
Container suse/kiosk/firefox-esr:140.14-75.12 Affected
SUSE Linux Enterprise Desktop 15 SP7 SUSE Linux Enterprise High Performance Computing 15 SP7 SUSE Linux Enterprise Module for Desktop Applications 15 SP7 SUSE Linux Enterprise Server 15 SP7 SUSE Linux Enterprise Server for SAP Applications 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS Fixed
SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS Fixed
SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS Fixed

References

Advisories & patches
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-74960 ADVISORY https://vuldb.com/vuln/391612 ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:3658/ REF https://bugzilla.mozilla.org/show_bug.cgi?id=2049148 REF https://www.mozilla.org/security/advisories/mfsa2026-74/ REF https://www.mozilla.org/security/advisories/mfsa2026-76/ REF https://www.mozilla.org/security/advisories/mfsa2026-77/ REF https://www.mozilla.org/security/advisories/mfsa2026-78/ REF https://www.mozilla.org/security/advisories/mfsa2026-79/ REF https://www.mozilla.org/security/advisories/mfsa2026-80/

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy