CVE-2026-8971

MediumCVSS 6.5

Published: 19/05/2026(UTC)Updated: 23/07/2026(UTC)Translated: 25/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.21%

11th percentile - higher than 11% of all known CVEs

Summary

A same-origin policy bypass exists in the Networking: JAR component of Firefox and Thunderbird. This vulnerability was fixed in Firefox 151 and Thunderbird 151.

Risk Assessment

An attacker can bypass the same-origin policy, potentially leading to data theft or unauthorized actions in the context of another site.

Recommendation

Update Firefox and Thunderbird to version 151 or later.

Original NVD description (English source)

Same-origin policy bypass in the Networking: JAR component. This vulnerability was fixed in Firefox 151 and Thunderbird 151.