CVE-2026-74963 in Firefox
Summary
by MITRE • 08/18/2026
Same-origin policy bypass in the Networking: Cookies component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, and Firefox ESR 153.1.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 08/18/2026
The identified vulnerability represents a critical failure in the implementation of the Same-Origin Policy within Mozilla Firefox's Networking: Cookies subsystem. The Same-Origin Policy is a fundamental security mechanism for web browsers that restricts how a document or script loaded from one origin can interact with resources from another origin. This isolation prevents malicious scripts on one page from obtaining access to sensitive data such as cookies, local storage, or the DOM of another site without explicit permission via mechanisms like CORS. In this specific instance, the flaw allows an attacker to bypass these restrictions, effectively breaking the trust boundary that separates different web origins. The vulnerability was addressed in Firefox version 154, as well as in the Extended Support Release versions 140.14 and 153.1, indicating a significant update cycle for stability-focused releases where such security patches are prioritized to protect enterprise and long-term users.
From a technical perspective, this flaw likely stems from an inconsistency in how cookie attributes or domain matching rules were evaluated during network requests. When the browser processes HTTP responses containing Set-Cookie headers, it must strictly adhere to RFC 6265 standards regarding scope, path, and domain constraints. A bypass suggests that under certain conditions, such as specific combinations of subdomains, port numbers, or malformed header values, the browser incorrectly associated cookies with a different origin than intended. This misalignment allows scripts originating from an attacker-controlled site to read or manipulate session tokens belonging to a victim's authenticated session on a trusted domain. Such errors are particularly dangerous because they undermine the core assumption that cross-origin requests cannot access protected state data unless explicitly allowed by the server through secure headers like SameSite, which may also be circumvented if the underlying cookie handling logic is flawed.
The operational impact of this vulnerability is severe, primarily facilitating session hijacking and unauthorized data exfiltration. An attacker could craft a malicious webpage that, when visited by an authenticated user of a target service, executes scripts capable of stealing sensitive cookies such as authentication tokens or session identifiers. With these credentials in hand, the attacker can impersonate the victim, gaining full access to their account without needing to guess passwords or exploit other vulnerabilities. This type of attack is often executed via Cross-Site Request Forgery (CSRF) variants where stolen cookies are used to perform actions on behalf of the user, or through simple data theft if sensitive information like personal details or financial records are stored within accessible cookie fields. The risk is amplified in environments where users frequently visit untrusted sites while logged into critical applications such as banking portals, email services, or enterprise dashboards.
This vulnerability aligns with CWE-200, which classifies it as an Information Exposure vulnerability, specifically detailing how sensitive information becomes available to unauthorized actors due to improper access control mechanisms. Furthermore, from the perspective of the MITRE ATT&CK framework, this flaw supports techniques related to Credential Access and Session Hijacking, such as T1539 Steal Web Session Cookie or T1078 Valid Accounts if combined with other exploitation vectors. The ability to bypass same-origin restrictions is a classic precursor to more complex attack chains involving data theft and lateral movement within web application ecosystems.
To mitigate the risks associated with this class of vulnerabilities, organizations must ensure that all endpoints running Firefox are updated to version 154 or later for standard releases, or ESR versions 140.14 and 153.1 for extended support environments. Beyond patching, developers should enforce strict Content Security Policy (CSP) directives to limit the sources from which scripts can execute, thereby reducing the attack surface even if a browser-level bypass occurs. Additionally, implementing robust server-side protections such as HttpOnly flags on sensitive cookies prevents client-side script access entirely, while SameSite=Strict or Lax attributes restrict how cookies are sent with cross-site requests. Regular security audits and penetration testing focusing on cookie handling logic can help identify similar implementation flaws before they are exploited in the wild.