What is the CVSS score of CVE-2026-8962?

CVE-2026-8962 has a contested CVSS base score of 8.1 from a third party (e.g. CISA-ADP), while the vendor rates it High. vuln.today uses the vendor rating as authoritative.

Which versions of Mozilla Firefox are affected by CVE-2026-8962?

Mozilla Firefox (versions before 151 and ESR before 140.11) has an unpatched security bypass allowing attackers to compromise user data through malicious websites.. A patch is available.

How to fix or mitigate CVE-2026-8962?

Within 24 hours: Identify Firefox deployments and user counts; alert users to restrict browsing to trusted sites. Within 7 days: Monitor Mozilla advisories for Firefox 151 and ESR 140.11 release; prepare deployment plan. Within 30 days: Deploy Firefox 151 or ESR 140.11 to all affected endpoints immediately upon vendor release.

Mozilla Firefox CVE-2026-8962

EUVD-2026-30911 HIGH

Protection Mechanism Failure (CWE-693)

2026-05-19 mozilla

GHSA-93x2-246x-h3jh

Mozilla Authentication Bypass Red Hat Suse

High

Disputed · 8.1 NVD

Severity by source

Sources disagree (Low–High)

NVD PRIMARY

8.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

SUSE

HIGH

qualitative

Red Hat

3.4 LOW

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

May 20, 2026 - 17:25 vuln.today

CVSS changed

May 20, 2026 - 17:22 NVD

8.1 (HIGH)

CVE Published

May 19, 2026 - 12:29 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Mitigation bypass in the DOM: Security component. This vulnerability was fixed in Firefox 151 and Firefox ESR 140.11.

AnalysisAI

Mitigation bypass in Mozilla Firefox's DOM: Security component allows remote attackers to circumvent built-in browser security protections when a user visits a maliciously crafted web page. The flaw affects Firefox versions prior to 151 and Firefox ESR prior to 140.11, with CVSS 8.1 reflecting high confidentiality and integrity impact contingent on user interaction. EPSS scoring is very low (0.02%, 5th percentile) and no public exploit identified at time of analysis, but the CWE-693 protection-mechanism-failure classification means defensive layers users rely on may not function as intended.

Technical ContextAI

The vulnerability resides in Firefox's DOM: Security component, which implements browser-enforced web platform security mechanisms such as the Same-Origin Policy, Content Security Policy (CSP), Mixed Content Blocker, and related DOM-level protections that isolate web content. The CWE-693 (Protection Mechanism Failure) classification indicates that one of these mitigations can be bypassed rather than that memory corruption or code execution occurs directly - meaning a crafted page can sidestep a guardrail that web applications and users assume is enforced. Affected CPE is cpe:2.3:a:mozilla:firefox where the wildcard version reflects that all releases prior to the fixed builds (Firefox 151 and Firefox ESR 140.11) are in scope.

RemediationAI

Vendor-released patch: Firefox 151 and Firefox ESR 140.11 - upgrade Firefox to 151 or later on all desktop endpoints and Firefox ESR to 140.11 or later on managed/enterprise builds, distributing via the built-in updater, enterprise policy (Mozilla MSI/Policy Templates), or OS package managers, per Mozilla advisories MFSA2026-46, MFSA2026-48, MFSA2026-50, and MFSA2026-51 referenced above. Because the flaw requires user interaction with attacker-controlled web content, interim compensating controls include enforcing strict web filtering or DNS-based blocking of untrusted destinations (trade-off: may break legitimate sites and requires upkeep), enabling enterprise CSP and HTTPS-only mode policies to reduce cross-site attack surface (trade-off: some legacy intranet apps may misbehave), and routing browsing through a remote browser isolation service for high-risk users (trade-off: latency and licensing cost); switching browsers as a workaround is not recommended given a fix is available.

More in Mozilla

View all

CVE-2015-4495 HIGH Act Now POC

8.8 Aug 08

The PDF reader in Mozilla Firefox before 39.0.3, Firefox ESR 38.x before 38.1.1, and Firefox OS before 2.2 allows remote

CVE-2013-1690 HIGH Act Now POC

8.8 Jun 26

Mozilla Firefox before 22.0, Firefox ESR 17.x before 17.0.7, Thunderbird before 17.0.7, and Thunderbird ESR 17.x before

CVE-2013-0758 CRITICAL Emergency POC

9.3 Jan 13

Mozilla Firefox before 18.0, Firefox ESR 10.x before 10.0.12 and 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderb

CVE-2013-0753 CRITICAL Act Now POC

9.3 Jan 13

Use-after-free vulnerability in the serializeToStream implementation in the XMLSerializer component in Mozilla Firefox b

CVE-2012-3993 CRITICAL Emergency POC

9.3 Oct 10

The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbi

CVE-2013-1710 CRITICAL Emergency POC

10.0 Aug 07

The crypto.generateCRMFRequest function in Mozilla Firefox before 23.0, Firefox ESR 17.x before 17.0.8, Thunderbird befo

CVE-2017-3823 HIGH Act Now POC

8.8 Feb 01

An issue was discovered in the Cisco WebEx Extension before 1.0.7 on Google Chrome, the ActiveTouch General Plugin Conta

CVE-2014-8636 HIGH Act Now POC

7.5 Jan 14

The XrayWrapper implementation in Mozilla Firefox before 35.0 and SeaMonkey before 2.32 does not properly interact with

CVE-2013-0757 CRITICAL Emergency POC

9.3 Jan 13

The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 18.0, Firefox ESR 17.x before 17.0.2, Thunderbi

CVE-2014-1510 CRITICAL Emergency POC

9.8 Mar 19

The Web IDL implementation in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and Se

CVE-2014-1511 CRITICAL Emergency POC

9.8 Mar 19

Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and SeaMonkey before 2.25 allow remo

CVE-2013-0643 HIGH Act Now

8.8 Feb 27

The Firefox sandbox in Adobe Flash Player before 10.3.183.67 and 11.x before 11.6.602.171 on Windows and Mac OS X, and b

Same weakness CWE-693 – Protection Mechanism Failure

View all

CVE-2013-2465 CRITICAL POC

9.8

CVE-2013-0431 MEDIUM POC

5.3

CVE-2025-40536 HIGH POC

8.1

CVE-2026-21513 HIGH

8.8

CVE-2026-21510 HIGH POC

8.8

CVE-2026-32202 MEDIUM POC

4.3

CVE-2017-10952 HIGH POC

8.8

CVE-2022-32845 CRITICAL POC

10.0

Same technique Authentication Bypass

View all

CVE-2023-22515 CRITICAL POC

9.8

CVE-2012-4681 CRITICAL POC

9.8

CVE-2013-2465 CRITICAL POC

9.8

CVE-2011-3544 CRITICAL POC

9.8

CVE-2012-1723 CRITICAL POC

9.8

CVE-2017-10271 HIGH POC

7.5

CVE-2015-1427 CRITICAL POC

9.8

CVE-2025-3248 CRITICAL POC

9.8

Vendor StatusVendor

SUSE

Severity: High

Product	Status
SUSE Linux Enterprise Server 12 SP5-LTSS	Fixed
SUSE Linux Enterprise Server LTSS Extended Security 12 SP5	Fixed
openSUSE Tumbleweed	Fixed
SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS	Affected
SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS	Affected

CVE-2026-8962 vulnerability details – vuln.today

Back

Mozilla Firefox CVE-2026-8962

Severity by source

CVSS VectorNVD

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Technical ContextAI

RemediationAI

More in Mozilla

Same weakness CWE-693 – Protection Mechanism Failure

Same technique Authentication Bypass

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code