Skip to main content

Mozilla Firefox CVE-2026-8948

| EUVDEUVD-2026-30900 CRITICAL
Permissive Cross-domain Security Policy with Untrusted Domains (CWE-942)
2026-05-19 mozilla GHSA-j9gx-gpjh-cwc4
Authentication Bypass Mozilla Cors Misconfiguration
9.1
CVSS 3.1 · Vendor: mozilla
Share

Severity by source

Vendor (mozilla) PRIMARY
9.1 CRITICAL
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
vuln.today AI
8.1 HIGH

Network-reachable SOP bypass with low complexity and no auth, but realistically needs the victim to load attacker content, so UI:R; high C/I, no availability impact.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
SUSE
CRITICAL
qualitative
Red Hat
7.5 HIGH
qualitative

Primary rating from Vendor (mozilla).

CVSS VectorVendor: mozilla

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
None

Lifecycle Timeline

3
Analysis Generated
Jul 23, 2026 - 17:49 vuln.today
CVE Published
May 19, 2026 - 12:29 nvd
UNKNOWN (no severity yet)
CVE Published
May 19, 2026 - 12:29 cve.org
CRITICAL 9.1

DescriptionCVE.org

Same-origin policy bypass in the DOM: Networking component. This vulnerability was fixed in Firefox 151.

AnalysisAI

Same-origin policy bypass in Mozilla Firefox's DOM: Networking component allows a malicious web page to read cross-origin responses that should be blocked, defeating a core browser isolation boundary. Rated CVSS 9.1 with high confidentiality and integrity impact, the flaw was fixed in Firefox 151 (MFSA2026-46/MFSA2026-50). There is no public exploit identified at time of analysis; EPSS is very low (0.03%, 8th percentile) and CISA SSVC lists exploitation status as none, but the issue is assessed as automatable with total technical impact.

Technical ContextAI

The vulnerability lives in Firefox's DOM Networking layer, which enforces the browser's same-origin policy (SOP) and CORS rules governing which cross-origin resources script running on one origin may read. CWE-942 (Permissive Cross-domain Policy with Untrusted Domains) indicates the browser applied an overly permissive origin/access-control decision, letting content from one origin obtain responses or state belonging to another origin. Because SOP is the foundation of web isolation, a bypass here undermines protections for authenticated session data, cross-site request confidentiality, and CORS-gated APIs. The single affected CPE is cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*, i.e., the Firefox desktop browser prior to version 151.

RemediationAI

Vendor-released patch: Firefox 151 - upgrade all Firefox instances to version 151 or later, which is the primary and complete fix per Mozilla advisories MFSA2026-46 (https://www.mozilla.org/security/advisories/mfsa2026-46/) and MFSA2026-50 (https://www.mozilla.org/security/advisories/mfsa2026-50/). Enterprises deploying Firefox via managed channels should push the update through their software distribution system and confirm ESR builds are on a fixed release. On Linux distributions, apply the vendor's updated firefox package (see Red Hat tracking at https://access.redhat.com/security/cve/CVE-2026-8948 and VEX data at https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-8948.json). No SOP-specific configuration workaround is published; as a compensating control until updates roll out, restrict browsing of untrusted sites (e.g., enforce browsing policy or network egress filtering to limit access to attacker-controlled pages) - this reduces exposure but degrades normal web usability and is only a stopgap, since patching to 151 is the authoritative fix.

More in Cors Misconfiguration

View all
CVE-2024-41657 HIGH POC
8.8 Aug 20

Casdoor is a UI-first Identity and Access Management (IAM) / Single-Sign-On (SSO) platform. Rated high severity (CVSS 8.
CVE-2021-34435 HIGH POC
8.8 Sep 01

In Eclipse Theia 0.3.9 to 1.8.1, the "mini-browser" extension allows a user to preview HTML files in an iframe inside th
CVE-2026-84452 HIGH POC
8.6 Sep 02

Unauthenticated cross-origin RCE in Windows ML CLI (winml-cli < 0.4.0) is reachable when a developer runs the `serve` co
CVE-2025-30354 HIGH POC
8.7 Apr 01

Bruno is an open source IDE for exploring and testing APIs. Rated high severity (CVSS 8.7), this vulnerability is no aut
CVE-2024-41659 HIGH POC
8.1 Aug 20

memos is a privacy-first, lightweight note-taking service. Rated high severity (CVSS 8.1), this vulnerability is remotel
CVE-2026-70604 HIGH POC
7.4 Aug 05

Cross-origin read bypass in Electron's custom protocol handler exposes sensitive application data to remote pages via fe
CVE-2026-15966 CRITICAL
9.8 Jul 23

Information disclosure in Progress MOVEit Transfer (all versions before 2025.1.5, and 2026.0.0 before 2026.0.3) stems fr
CVE-2025-61163 CRITICAL
9.8 Aug 26

Sensitive-data exposure in Cohere North AI v1.1.5 stems from the server accepting cross-origin requests without validati
CVE-2024-37131 CRITICAL
9.8 Jun 13

SCG Policy Manager, all versions, contains an overly permissive Cross-Origin Resource Policy (CORP) vulnerability. Rated
CVE-2022-26969 CRITICAL
9.8 Dec 26

In Directus before 9.7.0, the default settings of CORS_ORIGIN and CORS_ENABLED are true. Rated critical severity (CVSS 9
CVE-2022-31736 CRITICAL
9.8 Dec 22

A malicious website could have learned the size of a cross-origin resource that supported Range requests. Rated critical
CVE-2026-34449 CRITICAL
9.6 Mar 31

Remote code execution in SiYuan desktop application (versions prior to 3.6.2) allows unauthenticated remote attackers to

Same weakness CWE-942 – Permissive Cross-domain Security Policy with Untrusted Domains

View all
CVE-2024-41657 HIGH POC
8.8
CVE-2021-34435 HIGH POC
8.8
CVE-2026-84452 HIGH POC
8.6
CVE-2025-30354 HIGH POC
8.7
CVE-2024-41659 HIGH POC
8.1
CVE-2026-70604 HIGH POC
7.4
CVE-2026-25478 HIGH POC
7.4
CVE-2026-15966 CRITICAL
9.8

Same technique Authentication Bypass

View all
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2022-40684 CRITICAL POC
9.8
CVE-2025-61882 CRITICAL POC
9.8
CVE-2024-0012 CRITICAL POC
9.3
CVE-2023-46805 HIGH POC
8.2

Vendor StatusVendor

SUSE

Severity: Critical
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed
SUSE Linux Enterprise Module for Desktop Applications 15 SP7 Fixed
SUSE Linux Enterprise Module for Package Hub 15 SP7 Fixed

Share

CVE-2026-8948 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy