What is the CVSS score of CVE-2026-8970?

CVE-2026-8970 has a contested CVSS base score of 8.8 from a third party (e.g. CISA-ADP), while the vendor rates it High. vuln.today uses the vendor rating as authoritative.

Which versions of Mozilla Firefox are affected by CVE-2026-8970?

Firefox users face a privilege escalation vulnerability (CVE-2026-8970, CVSS 8.8) allowing attackers to compromise browser security through malicious website interactions-a frequent attack vector for…. A patch is available.

How to fix or mitigate CVE-2026-8970?

24 hours: Complete inventory of Firefox and Firefox ESR across all endpoints; issue security advisory recommending users switch to patched browsers (Chrome, Safari, Edge) for sensitive tasks; deploy proxy rules blocking high-risk domains. 7 days: Implement Group Policy or MDM restrictions limiting Firefox to internal/trusted sites only; activate network-level inspection (CASB/proxy) for web traffic analysis; configure alert subscriptions to Mozilla security advisories. 30 days: Deploy Firefox version 151 or ESR 140.11+ immediately upon release via standard patch management tools; verify 100% endpoint compliance within 72 hours of deployment; document interim control removal timeline once patch adoption exceeds 95%.

Mozilla Firefox CVE-2026-8970

EUVD-2026-30920 HIGH

Improper Privilege Management (CWE-269)

2026-05-19 mozilla

GHSA-qqf4-pjxf-9rj2

Mozilla Privilege Escalation Red Hat Suse

High

Disputed · 8.8 NVD

Severity by source

Sources disagree (Low–High)

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

3.4 LOW

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 20, 2026 - 17:26 vuln.today

CVSS changed

May 20, 2026 - 17:22 NVD

7.3 (HIGH) 8.8 (HIGH)

CVE Published

May 19, 2026 - 12:30 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Privilege escalation in the Security component. This vulnerability was fixed in Firefox 151 and Firefox ESR 140.11.

AnalysisAI

Privilege escalation in Mozilla Firefox's Security component allows remote attackers to elevate privileges within the browser when a victim interacts with attacker-controlled content, affecting Firefox versions prior to 151 and Firefox ESR prior to 140.11. With CVSS 8.8 (high) and user interaction required, exploitation is plausible via malicious web content, though EPSS sits at just 0.04% (12th percentile) and no public exploit identified at time of analysis. SSVC rates exploitation as 'none' but flags the issue as automatable with partial technical impact, suggesting concerning scalability if a working exploit emerges.

Technical ContextAI

The vulnerability resides in Firefox's Security component and is classified under CWE-269 (Improper Privilege Management), a root cause class where software fails to properly assign, track, or enforce privilege boundaries between security principals. In a browser context, this typically involves the boundary between web content (low-privilege renderer/content process) and browser-privileged operations such as chrome JavaScript, internal APIs, or system-level capabilities. The affected CPE is cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*, covering Firefox releases up to the fixed builds, with Firefox ESR 140.11 serving as the long-term support branch fix. Mozilla coordinated disclosure across multiple advisories (MFSA2026-46, -48, -50, -51), indicating the issue may span multiple release trains.

RemediationAI

Vendor-released patch: upgrade to Firefox 151 or later, and Firefox ESR 140.11 or later, per Mozilla advisories MFSA2026-46, MFSA2026-48, MFSA2026-50, and MFSA2026-51 (https://www.mozilla.org/security/advisories/mfsa2026-46/ and related URLs). Enterprises pinned to ESR should prioritize the 140.11 update through their managed deployment channel (e.g., MSI/policy/MDM) rather than waiting for the next quarterly window. As compensating controls until patching completes, restrict browsing to trusted sites via enterprise policy, enable strict tracking protection and disable JavaScript on untrusted origins via uBlock Origin or NoScript (trade-off: breaks many modern sites), and consider deploying Firefox in a containerized or sandboxed environment such as Firejail on Linux or Windows Sandbox to limit blast radius if the in-browser privilege boundary is crossed.

More in Mozilla

View all

CVE-2015-4495 HIGH Act Now POC

8.8 Aug 08

The PDF reader in Mozilla Firefox before 39.0.3, Firefox ESR 38.x before 38.1.1, and Firefox OS before 2.2 allows remote

CVE-2013-1690 HIGH Act Now POC

8.8 Jun 26

Mozilla Firefox before 22.0, Firefox ESR 17.x before 17.0.7, Thunderbird before 17.0.7, and Thunderbird ESR 17.x before

CVE-2013-0758 CRITICAL Emergency POC

9.3 Jan 13

Mozilla Firefox before 18.0, Firefox ESR 10.x before 10.0.12 and 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderb

CVE-2013-0753 CRITICAL Act Now POC

9.3 Jan 13

Use-after-free vulnerability in the serializeToStream implementation in the XMLSerializer component in Mozilla Firefox b

CVE-2012-3993 CRITICAL Emergency POC

9.3 Oct 10

The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbi

CVE-2013-1710 CRITICAL Emergency POC

10.0 Aug 07

The crypto.generateCRMFRequest function in Mozilla Firefox before 23.0, Firefox ESR 17.x before 17.0.8, Thunderbird befo

CVE-2017-3823 HIGH Act Now POC

8.8 Feb 01

An issue was discovered in the Cisco WebEx Extension before 1.0.7 on Google Chrome, the ActiveTouch General Plugin Conta

CVE-2014-8636 HIGH Act Now POC

7.5 Jan 14

The XrayWrapper implementation in Mozilla Firefox before 35.0 and SeaMonkey before 2.32 does not properly interact with

CVE-2013-0757 CRITICAL Emergency POC

9.3 Jan 13

The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 18.0, Firefox ESR 17.x before 17.0.2, Thunderbi

CVE-2014-1510 CRITICAL Emergency POC

9.8 Mar 19

The Web IDL implementation in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and Se

CVE-2014-1511 CRITICAL Emergency POC

9.8 Mar 19

Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and SeaMonkey before 2.25 allow remo

CVE-2013-0643 HIGH Act Now

8.8 Feb 27

The Firefox sandbox in Adobe Flash Player before 10.3.183.67 and 11.x before 11.6.602.171 on Windows and Mac OS X, and b

Same weakness CWE-269 – Improper Privilege Management

View all

CVE-2017-5689 CRITICAL POC

9.8

CVE-2017-12635 CRITICAL POC

9.8

CVE-2012-3993 CRITICAL POC

9.3

CVE-2017-11467 CRITICAL POC

9.8

CVE-2014-1510 CRITICAL POC

9.8

CVE-2014-1511 CRITICAL POC

9.8

CVE-2016-0151 HIGH POC

7.8

CVE-2013-0643 HIGH

8.8

Same technique Privilege Escalation

View all

CVE-2025-47812 CRITICAL POC

10.0

CVE-2013-0422 CRITICAL POC

9.8

CVE-2013-0632 CRITICAL POC

9.8

CVE-2017-5689 CRITICAL POC

9.8

CVE-2017-12635 CRITICAL POC

9.8

CVE-2016-10372 CRITICAL POC

9.8

CVE-2014-9583 CRITICAL POC

10.0

CVE-2012-0297 CRITICAL POC

10.0

Vendor StatusVendor

SUSE

Severity: High

Product	Status
SUSE Linux Enterprise Server 12 SP5-LTSS	Fixed
SUSE Linux Enterprise Server LTSS Extended Security 12 SP5	Fixed
openSUSE Tumbleweed	Fixed
SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS	Affected
SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS	Affected

CVE-2026-8970 vulnerability details – vuln.today

Back

Mozilla Firefox CVE-2026-8970

Severity by source

CVSS VectorNVD

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Technical ContextAI

RemediationAI

More in Mozilla

Same weakness CWE-269 – Improper Privilege Management

Same technique Privilege Escalation

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code