EUVD-2026-88800
GHSA-r8hv-xg2w-55rq
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessHost crafted web page
-
DeliveryLure victim to load it (UI:R)
-
ExploitTrigger Panning/Zooming site-isolation bypass
-
ExecutionCross-origin boundary defeated
-
ImpactRead limited cross-origin data (C:L)
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Origin validation
|
| Exploitation Conditions | Exploitation requires an unpatched Firefox build (anything before Firefox 157, ESR 153.4, ESR 140.17, or ESR 115.42) and the victim must actively load attacker-controlled web content (UI:R) in the vulnerable browser. No authentication or special privileges are needed (PR:N), and default configurations are affected - site isolation is a built-in security boundary, not an opt-in feature. The practical limiting factor is user interaction plus the narrow payoff: only a limited cross-origin confidentiality leak (C:L) is achievable, with no integrity or availability impact, so it is most useful as one link in a larger chain rather than a standalone compromise. Firefox's silent auto-update further shortens the real-world exposure window. |
| Impact | All signals point to a low-priority, defense-in-depth issue rather than an urgent threat. The CVSS 3.1 base score is 4.7 (Medium-low) with vector AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N: network-reachable and low-complexity, but it requires user interaction (victim must load attacker content) and yields only limited confidentiality impact (C:L) with no integrity or availability effect. The scope change (S:C) reflects that a bypass of Firefox's site-isolation boundary lets content from one origin observe data belonging to another - a cross-origin confidentiality leak, not code execution. EPSS is 0.16% (4th percentile), consistent with the near-zero historical exploitation of individual browser site-isolation bugs. There is no CISA KEV listing and no public exploit identified. No SSVC decision data was provided in the input. The signals are mutually consistent (low CVSS + low EPSS + no KEV + no POC + info-disclosure-only), so there is no conflict to resolve. Net: a real but low-urgency hardening fix that matters mainly at scale across the browser's large install base, best handled through routine browser auto-update. |
| Exploit ScenarioDerived | An attacker lures a Firefox user to a malicious or compromised web page that triggers the flaw in the Panning and Zooming component to defeat site isolation. Because of the boundary bypass, the attacker's page can observe a limited amount of information that should have remained confined to another origin (e.g., cross-origin content). No public exploit code has been identified, and the attack succeeds only against an unpatched browser whose user actually loads the crafted page. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 01, 2026
Cross-origin information disclosure in Mozilla Firefox's panning and zooming component lets attacker-controlled web content defeat the browser's site-isolation boundary and leak a limited amount of data from another origin. The issue affects Firefox builds prior to 157, ESR 153.4, ESR 140.17, and ESR 115.42, and requires the victim to load a malicious page (UI:R) with no authentication or special privileges (PR:N); impact is confined to confidentiality (C:L) with no integrity or availability effect. There is no public exploit identified at time of analysis and no CISA KEV listing, and the EPSS score of 0.16% (4th percentile) indicates very low predicted exploitation activity, making this a defense-in-depth fix rather than an urgent threat.
RemediationAI
Vendor-released patches are available: upgrade to Firefox 157 on the rapid-release channel, or to Firefox ESR 153.4, Firefox ESR 140.17, or Firefox ESR 115.42 on the corresponding ESR branches, per Mozilla advisories mfsa2026-97 through mfsa2026-103 (for example https://www.mozilla.org/security/advisories/mfsa2026-100/ and https://www.mozilla.org/security/advisories/mfsa2026-101/), with technical detail in https://bugzilla.mozilla.org/show_bug.cgi?id=2071784. Organizations that cannot patch immediately should rely on Firefox's silent auto-update where policy allows it, and otherwise should verify deployed versions through enterprise policy tooling to catch pinned or lagging ESR 115.x installs, which are the most likely to remain unpatched. Because exploitation requires the user to load attacker-controlled content and yields only a limited cross-origin read, meaningful compensating controls are to confine high-value sessions (webmail, admin consoles, SSO) to a separate browser or container profile so a leaked origin cannot reach authenticated data, and to restrict browsing of untrusted sites in the vulnerable build; the trade-off is added user friction and the need for explicit profile/container policies, and neither control addresses the underlying isolation defect the way the version upgrade does.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerable code lives in Firefox's panning and zooming subsystem - the asynchronous pan/zoom (APZ) input-handling path that runs partly outside the content process to keep scrolling and pinch gestures responsive. Because APZ and the compositor sit between processes, an origin-validation error there (CWE-346) can let content from one origin influence or observe state belonging to another, weakening Fission/site isolation, the security boundary Firefox relies on to separate origins within a single browser instance. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N describes network-delivered content, low attack complexity, no privileges required, mandatory user interaction, a scope change (S:C) reflecting the boundary violation, and only limited confidentiality loss. Exploitation therefore yields a partial cross-origin read primitive - useful for chaining into a more complete attack, but not a standalone compromise. The fix aligns with Mozilla's coordinated release train (advisories mfsa2026-97 through mfsa2026-103, bug 2071784, EUVD-2026-88800), and the affected CPE string cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:* covers all unpatched Firefox release channels.
Know when Firefox gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N
Web-delivered so AV:N/AC:L/PR:N, but the victim must load the page (UI:R); site-isolation bypass crosses a security boundary (S:C) and leaks limited cross-origin data only (C:L, no I/A).
Primary rating from Vendor (mozilla).
CVSS VectorVendor: mozilla
Lifecycle Timeline
3DescriptionCVE.org
Site isolation issue in the Panning and Zooming component. This vulnerability was fixed in Firefox ESR 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Affected Products (CPE)CVE.org
Mozilla Firefox before 18.0, Firefox ESR 10.x before 10.0.12 and 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderb
Use-after-free vulnerability in the serializeToStream implementation in the XMLSerializer component in Mozilla Firefox b
The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbi
The crypto.generateCRMFRequest function in Mozilla Firefox before 23.0, Firefox ESR 17.x before 17.0.8, Thunderbird befo
The XrayWrapper implementation in Mozilla Firefox before 35.0 and SeaMonkey before 2.32 does not properly interact with
The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 18.0, Firefox ESR 17.x before 17.0.2, Thunderbi
The Web IDL implementation in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and Se
Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and SeaMonkey before 2.25 allow remo
Integer underflow in the nsHtml5TreeBuilder class in the HTML5 string parser in Mozilla Firefox before 45.0 and Firefox
Mozilla Firefox before 37.0, Firefox ESR 31.x before 31.6, and Thunderbird before 31.6 do not properly restrict resource
Mozilla Firefox before 37.0 relies on docshell type information instead of page principal information for Window.webidl
The RC4 algorithm, as used in the TLS protocol and SSL protocol, has many single-byte biases, which makes it easier for
Exploit-DB