CVE-2026-74956

CriticalCVSS 9.1

Published: 18/08/2026(UTC)Updated: 19/08/2026(UTC)Translated: 19/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.28%

21th percentile - higher than 21% of all known CVEs

Summary

Same-origin policy bypass in the DOM: Service Workers component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1.

Risk Assessment

Bypassing the same-origin policy could allow an attacker to access data from other origins, potentially leading to data theft or session hijacking.

Recommendation

Update Firefox and Thunderbird to versions containing the fixes.

Original NVD description (English source)

Same-origin policy bypass in the DOM: Service Workers component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1.