CVE-2026-74956

Analyzed Analyzed - Analysis Complete

Same-origin policy bypass in Firefox DOM Service Workers

Publication date: 2026-08-18

Last updated on: 2026-08-19

Assigner: Mozilla Corporation

Description

Same-origin policy bypass in the DOM: Service Workers component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-18

Last Modified

2026-08-19

Generated

2026-09-07

AI Q&A

2026-08-18

EPSS Evaluated

2026-09-06

NVD

CVE-2026-74956

EUVD

EUVD-2026-60683

Affected Vendors & Products

Vendor	Product	Version / Range
mozilla	firefox	to 154.0.0 (exc)
mozilla	thunderbird	to 154.0 (exc)
mozilla	firefox	to 153.1.0 (exc)
mozilla	thunderbird	to 153.1.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-843	The product allocates or initializes a resource such as a pointer, object, or variable using one type, but it later accesses that resource using a type that is incompatible with the original type.

Attack-Flow Graph

Executive Summary

This vulnerability is a same-origin policy bypass in the DOM: Service Workers component. The same-origin policy is a security feature that restricts how documents or scripts from one origin interact with resources from another origin. A bypass here could allow malicious actors to access or manipulate data across different origins, potentially leading to unauthorized data access or other security issues.

Detection Guidance

This vulnerability is specific to Firefox versions before 154, Firefox ESR before 153.1, Thunderbird versions before 154, and Thunderbird ESR before 153.1. Detection involves checking installed versions of these applications.

Impact Analysis

If exploited, this vulnerability could allow attackers to bypass security restrictions and access sensitive data from different origins. This might lead to unauthorized access to user information, session hijacking, or other malicious activities depending on the context of the affected application.

Compliance Impact

This vulnerability could lead to unauthorized data access, which may violate compliance requirements under GDPR (data protection) or HIPAA (health information privacy). Organizations using affected Firefox versions might face legal and regulatory penalties due to insufficient data protection measures.

Mitigation Strategies

Update Firefox to version 154 or later and Firefox ESR to version 153.1 or later to address the same-origin policy bypass in Service Workers.

Hi! I’m here to help you understand CVE-2026-74956. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70