CVE-2026-8948

CriticalCVSS 9.1

Published: 19/05/2026(UTC)Updated: 15/07/2026(UTC)Translated: 16/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.42%

34th percentile - higher than 34% of all known CVEs

Summary

A vulnerability in the Networking component of Firefox and Thunderbird allows bypassing the same-origin policy (SOP) in the DOM. The flaw was fixed in version 151 of both products.

Risk Assessment

An attacker could exploit this vulnerability to read or modify data from other origins, leading to theft of sensitive information such as session cookies or authentication tokens.

Recommendation

Immediately update Firefox and Thunderbird to version 151 or later. Ensure the updates are deployed on all workstations in the organization.

Original NVD description (English source)

Same-origin policy bypass in the DOM: Networking component. This vulnerability was fixed in Firefox 151 and Thunderbird 151.