CVE-2026-74963

Same-origin policy bypass in the Networking: Cookies component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.

Published 18 Aug 2026, 13:17 UTC Last modified 19 Aug 2026, 01:00 UTC

5.4

CVSS 3.1 MEDIUM base score CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

Attack profile

The conditions required to exploit this vulnerability and its potential impact.

Attack vector Network

Attack complexity Low

Privileges required None

User interaction Required

Scope Unchanged

Confidentiality Low

Integrity Low

Availability None

Exploitability2.8

Impact2.5

Affected products

Product applicability statements supplied with the NVD record.

VendorProductAffected version

Mozilla Firefox before 140.14.0

Mozilla Firefox before 154.0.0

Mozilla Thunderbird before 140.14.0

Mozilla Thunderbird before 154.0

Mozilla Thunderbird from 153.0 (inclusive) before 153.1.0

Weakness classification

CWE categories help security teams group the underlying software weakness.

CWECWE-346

Source references

External advisories, patches and technical reports attached to this CVE record.

NVD National Vulnerability Database recordnvd.nist.gov 01 Permissions Required security@mozilla.org 02 Vendor Advisory security@mozilla.org 03 Vendor Advisory security@mozilla.org 04 Vendor Advisory security@mozilla.org 05 Vendor Advisory security@mozilla.org 06 Vendor Advisory security@mozilla.org 07 Vendor Advisory security@mozilla.org