CVE-2026-3846: 
NixOS vulnerability analysis and mitigation

CVE-2026-3846 is a same-origin policy (SOP) bypass vulnerability in Firefox's CSS Parsing and Computation component, allowing an attacker to read cross-origin CSS rules and leak redirect destination URLs. It was reported by Jun Yang (alias "juny24602" / "varde") and disclosed on March 10, 2026, via Mozilla Security Advisory MFSA2026-19. The vulnerability affects Firefox versions prior to 148.0.2 on all platforms including Android; ESR branches (115 and 140) are unaffected. It carries a CVSS v3.1 base score of 6.5 (Medium) (Mozilla Advisory, Feedly).

The root cause is an Origin Validation Error (CWE-346) in the StyleSheetInfo copy constructor within Firefox's CSS engine. When two <link> elements load the same cross-origin CSS URL, Firefox's SharedStyleSheetCache deduplicates them into a shared StyleSheetInfo inner object. Modifying the stylesheet's MediaList (e.g., via sheet.media.appendMedium()) triggers WillDirty() → EnsureUniqueInner() → CloneFor(), which invokes the StyleSheetInfo copy constructor. This constructor copies mCORSMode, mIntegrity, mSourceMapURL, and mContents, but critically omits mOriginClean — which defaults to true in the cloned object, bypassing the CSSOM origin-clean check. The fix is a one-line addition to copy mOriginClean in the copy constructor. A proof-of-concept HTML file (poc.html) was attached to the Bugzilla report by the reporter and a patch (test.patch) was also provided (Mozilla Bugzilla).

Successful exploitation allows a malicious web page to read CSS rules from cross-origin stylesheets and, when those stylesheets were loaded via HTTP redirects, leak the redirect destination URL — both of which are normally protected by the same-origin policy. This can expose sensitive information embedded in cross-origin stylesheets (e.g., authenticated user-specific styles or tokens) and reveal internal redirect URLs that may disclose private infrastructure or session-related paths. The vulnerability has no impact on availability and does not allow code execution, but the integrity impact is rated high due to the ability to violate browser security boundaries (Mozilla Advisory, Mozilla Bugzilla).

No public exploit kit or weaponized exploit has been observed in the wild. A proof-of-concept HTML file was submitted by the reporter as part of the responsible disclosure process and is attached to the Bugzilla report, but it is marked as restricted. The EPSS score is approximately 0.014% (0.000140), indicating very low probability of exploitation in the near term. There is no evidence of active in-the-wild exploitation, no threat actor attribution, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Feedly, Mozilla Bugzilla).

1. Setup malicious page: Host a web page on an attacker-controlled origin that loads a cross-origin stylesheet (e.g., from a target site) twice using two <link> elements pointing to the same URL.
2. Trigger cache deduplication: Firefox's SharedStyleSheetCache deduplicates the two stylesheet loads into a shared StyleSheetInfo inner object, with mOriginClean correctly set to false.
3. Trigger inner clone: Call sheet.media.appendMedium('screen') on one of the stylesheet objects. This invokes WillDirty() → EnsureUniqueInner() → CloneFor(), creating a new StyleSheetInfo via the copy constructor.
4. Exploit missing field copy: The cloned StyleSheetInfo initializes mOriginClean to true (its default), bypassing the CSSOM origin-clean check.
5. Read cross-origin CSS rules: Access sheet.cssRules on the now-"clean" sheet to enumerate all CSS rules from the cross-origin stylesheet.
6. Leak redirect URL (optional): If the stylesheet was loaded via an HTTP redirect, insert an @import rule and observe the resolved URL to leak the redirect destination (Mozilla Bugzilla).

• Network: Repeated requests from a browser to the same cross-origin CSS resource in rapid succession (two <link> loads of identical URL) from a suspicious or unfamiliar origin.
• Logs: Web server access logs showing the same CSS file fetched multiple times within milliseconds from the same client IP, potentially followed by unusual @import sub-requests.
• Browser Behavior: JavaScript errors or unexpected CSSOM access patterns in browser developer tools console related to cross-origin stylesheet manipulation.

Mozilla has released Firefox 148.0.2, which contains the fix for CVE-2026-3846. The fix adds mOriginClean(aCopy.mOriginClean) to the StyleSheetInfo copy constructor, ensuring the origin-clean flag is correctly propagated during inner cloning. Firefox ESR 115 and ESR 140 are unaffected and do not require updates. Users and administrators should update to Firefox 148.0.2 or later immediately; enabling automatic updates is the recommended approach (Mozilla Advisory, Mozilla Bugzilla).

The Center for Internet Security (CIS) published an advisory noting that multiple vulnerabilities in Mozilla Firefox, including CVE-2026-3846, could allow for arbitrary code execution (though this specific CVE is a SOP bypass, not RCE) (CIS Advisory). Mozilla's security team classified the issue as sec-high, consistent with their standard treatment of web same-origin policy violations. The bug was awarded a security bounty by Mozilla. Community coverage noted the similarity to CVE-2025-31205, a related WebKit cross-site CSS rule and redirect URL disclosure issue reported by Google Project Zero.