Executive brief
A security vulnerability has been identified in the Mozilla Firefox web browser's navigation component. This flaw allows a malicious website to bypass the 'Same-Origin Policy,' which is a fundamental security boundary that prevents websites from interacting with data from other sites. If exploited, an attacker could potentially access sensitive information or perform unauthorized actions on behalf of a user on different websites.
Technical details
A Same-Origin Policy (SOP) bypass exists in the DOM: Navigation component of Mozilla Firefox. The vulnerability allows for the circumvention of standard web security boundaries that isolate different origins. An attacker can exploit this by enticing a user to visit a specially crafted website, which could then potentially access sensitive data (such as cookies or DOM content) from other open sites or perform unauthorized cross-origin navigations. The issue is addressed in Firefox 153, Firefox ESR 115.38, and Firefox ESR 140.13. Specific root cause details are restricted in the associated Bugzilla report (Bug 2034682).
Affected products
- Mozilla Firefox < 153
- Mozilla Firefox ESR < 115.38, < 140.13
Timeline
- 2026-07-21: disclosed
- 2026-07-21: patched
- 2026-07-21: advisory