CVE-2026-100803 in Firefox
Summary
by MITRE • 09/29/2026
Same-origin policy bypass in the WebExtensions component. This vulnerability was fixed in Firefox ESR 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/29/2026
The identified vulnerability represents a critical failure in the Same-Origin Policy enforcement mechanisms within Mozilla's WebExtensions architecture. The Same-Origin Policy is a fundamental security concept for web browsers that restricts how a document or script loaded from one origin can interact with resources from another origin. In this specific instance, the flaw allows an extension to bypass these restrictions, effectively enabling cross-origin data access where it should be prohibited. This type of vulnerability undermines the isolation model that protects users from malicious websites and rogue extensions by allowing code running in a less privileged context to read sensitive information or execute actions on behalf of the user in a more privileged context without proper authorization checks.
From a technical perspective, this flaw likely stems from an improper validation of origin headers or permissions during cross-origin requests initiated through WebExtension APIs. When an extension attempts to fetch data from a different domain, the browser is responsible for verifying that the requesting extension has explicit permission to access that specific origin. The vulnerability suggests that there was a logic error in how these permissions were evaluated, potentially allowing extensions with broad host permissions or those exploiting race conditions to retrieve content from restricted origins. This bypass could be triggered by carefully crafted requests that exploit inconsistencies between different API endpoints used for network communication within the extension environment.
The operational impact of this vulnerability is significant as it compromises user privacy and data integrity. An attacker who can inject malicious code into a victim's browser, either through a compromised website or a rogue WebExtension, could use this flaw to exfiltrate sensitive information such as session cookies, authentication tokens, personal identifiable information, or financial details stored in local storage across different domains. This capability effectively neutralizes the security boundaries that prevent cross-site scripting attacks from escalating into full account takeovers or identity theft scenarios. Users relying on these browsers for secure browsing are exposed to potential data leakage without their knowledge or consent.
This issue aligns with CWE-200, which classifies information exposure vulnerabilities where sensitive system information is available to unauthorized actors. It also maps closely to MITRE ATT&CK technique T1537, specifically the sub-technique of Transfer Data to Cloud Account via Web Service, as it facilitates the exfiltration of data from local browser storage or active sessions to external servers controlled by an attacker. The vulnerability highlights the importance of rigorous permission scoping and origin validation in extension frameworks to prevent privilege escalation within the browser environment.
Mitigation for this issue has been addressed through software updates released across multiple branches of Firefox, including Firefox ESR 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17. Organizations should ensure that all endpoints running these browsers are updated to the latest patched versions immediately to close this security gap. Additionally, administrators should enforce strict extension policies using enterprise management tools to whitelist only trusted extensions and disable those with overly broad host permissions. Regular auditing of installed add-ons and monitoring for unusual network traffic patterns originating from browser processes can further enhance detection capabilities while relying on vendor patches for definitive remediation.