CVE-2026-74972 in Firefox
Summary
by MITRE • 08/18/2026
Information disclosure in the DOM: Push Subscriptions component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, and Firefox ESR 153.1.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 08/19/2026
The identified vulnerability represents a critical information disclosure flaw within the Document Object Model implementation of Mozilla Firefox, specifically affecting the Push Subscriptions component. This security issue arises from an improper handling or exposure of internal state data related to web push notifications, allowing maliciously crafted scripts running in one browsing context to access sensitive subscription details belonging to other contexts or tabs that should remain isolated under normal cross-origin policies. The root cause lies in a failure to properly enforce isolation boundaries when retrieving or exposing the list of active push subscriptions through JavaScript APIs such as getSubscriptions() or similar internal interfaces, potentially leaking endpoint URLs, registration identifiers, and associated metadata without adequate authorization checks or origin validation mechanisms.
From a technical perspective, this flaw exploits weaknesses in how the browser manages memory references and object serialization for service worker registrations tied to push services. When an attacker controls a webpage that can invoke these API methods under specific race conditions or through manipulated DOM states, they may retrieve subscription objects containing unique identifiers linked to user accounts on third-party websites. This data leakage enables attackers to correlate browsing activities across different sites by matching subscription endpoints with known service provider patterns, thereby undermining the privacy guarantees intended by modern web standards and browser sandboxing models. The vulnerability persists because certain internal methods did not sufficiently sanitize or restrict access based on the calling origin's permissions, leading to unintended side-channel information exposure.
The operational impact of this vulnerability is significant for user privacy and security posture. Attackers can leverage the disclosed push subscription data to perform targeted tracking across multiple websites that utilize push notification services for engagement purposes. By obtaining unique endpoint URLs or registration tokens, adversaries can fingerprint users even when traditional cookies are cleared or blocked, as these identifiers often remain persistent until explicitly uninstalled by the user. Furthermore, this information could facilitate more sophisticated phishing campaigns where attackers impersonate legitimate services using known subscription endpoints to send convincing malicious notifications directly to affected browsers. In severe cases, if combined with other vulnerabilities such as cross-site scripting flaws in vulnerable sites, it could lead to account takeover scenarios or unauthorized access to sensitive communications delivered via push channels.
Mitigation strategies primarily involve applying the vendor-provided patches released for Firefox 154 and Extended Support Release versions 140.14 and 153.1 immediately across all affected systems. Organizations should enforce strict software update policies to ensure timely deployment of these fixes, particularly in environments where users frequently interact with third-party services relying on push notifications. Additionally, implementing Content Security Policy directives that restrict access to potentially risky APIs can provide an additional layer of defense against exploitation attempts before patches are applied. Users are advised to regularly review and remove unused push subscriptions through browser settings to minimize the attack surface available for enumeration attacks.
This vulnerability aligns with Common Weakness Enumeration category CWE-200, which covers Information Exposure, specifically detailing scenarios where sensitive information is accessible without proper authorization controls. It also relates to MITRE ATT&CK technique T1539, which involves Steal Web Session Cookie, although in this case the stolen data consists of push subscription identifiers rather than traditional session cookies. The behavior mirrors aspects of cross-origin read bypasses found in other browsers where DOM APIs fail to properly isolate resources between different origins due to implementation oversights in permission checks or object reference handling. Security teams should monitor for any emerging exploits targeting similar patterns in service worker management and push notification infrastructure across various user agents to anticipate potential lateral movement opportunities derived from this initial foothold of information gathering.