CVE-2026-8950
Same-origin policy bypass in Firefox
Publication date: 2026-05-19
Last updated on: 2026-05-20
Assigner: Mozilla Corporation
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| mozilla | firefox | to 151.0.0 (exc) |
| mozilla | firefox | to 140.11.0 (exc) |
| mozilla | thunderbird | to 140.11 (exc) |
| mozilla | thunderbird | to 151.0.0 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-346 | The product does not properly verify that the source of data or communication is valid. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-8950 is a security vulnerability in the Networking: HTTP component of Mozilla Firefox and Firefox ESR. It involves a same-origin policy bypass, which means that the usual security restrictions that prevent one website from accessing data or resources from another website are circumvented. This vulnerability was fixed in Firefox 151 and Firefox ESR 140.11.
How can this vulnerability impact me? :
This vulnerability could allow malicious websites to bypass security restrictions imposed by the same-origin policy. As a result, attackers might gain unauthorized access to sensitive data or interact with other websites on behalf of the user, potentially leading to data theft or other malicious activities.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, you should update your Firefox browser to version 151 or later, or Firefox ESR to version 140.11 or later, where the issue has been fixed.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
CVE-2026-8950 involves a same-origin policy bypass in Firefox's Networking: HTTP component, which could allow malicious websites to bypass security restrictions and potentially access sensitive data or interact with other sites without authorization.
Such unauthorized access to sensitive data could have implications for compliance with data protection standards and regulations like GDPR and HIPAA, which require strict controls over personal and sensitive information to prevent unauthorized disclosure.
However, the provided information does not explicitly state the direct impact of this vulnerability on compliance with these standards.