CVE-2026-100803 | BDVDB-2026-380821 Detail
MozillaFirefox
Description#
Same-origin policy bypass in the WebExtensions component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.
Impact#
Per CVSS v3.1: confidentiality impact high, integrity impact high, availability impact none. Attack vector: network.
Weaknesses#
- CWE-346 Origin Validation Error
References#
- https://bugzilla.mozilla.org/show_bug.cgi?id=2057988
- https://www.mozilla.org/security/advisories/mfsa2026-100/
- https://www.mozilla.org/security/advisories/mfsa2026-101/
- https://www.mozilla.org/security/advisories/mfsa2026-102/
- https://www.mozilla.org/security/advisories/mfsa2026-103/
- https://www.mozilla.org/security/advisories/mfsa2026-97/
- https://www.mozilla.org/security/advisories/mfsa2026-98/
- https://www.mozilla.org/security/advisories/mfsa2026-99/
Exploit#
No public exploit known
History#
- Version 1Record published in the CVE List.
- Version 2Most recent update recorded in the CVE List.