Executive brief
A security vulnerability has been identified in the Mozilla Firefox web browser's DNS handling component. This flaw could allow a malicious website to bypass the Same-Origin Policy, which is a fundamental security mechanism that prevents websites from interacting with data from other sites. If exploited, an attacker could potentially access sensitive information or perform unauthorized actions on behalf of the user across different web domains.
Technical details
A Same-Origin Policy (SOP) bypass vulnerability exists in the Networking: DNS component of Mozilla Firefox. The flaw allows for the circumvention of origin-based security restrictions, which are designed to isolate web content from different sources. An attacker could exploit this by hosting a malicious website that, when visited by a user, interacts with or accesses data from other origins that should be restricted. The vulnerability was addressed by improving origin checks and DNS handling logic. It is fixed in Firefox 153 and Firefox ESR 140.13.
Affected products
- Mozilla Firefox before 153
- Mozilla Firefox ESR before 140.13
Timeline
- 2026-07-21: advisory
- 2026-07-21: patched