CVE-2026-74956: 
NixOS vulnerability analysis and mitigation

CVE-2026-74956 is a same-origin policy (SOP) bypass vulnerability in the DOM: Service Workers component of Mozilla Firefox and Thunderbird. Reported by researcher pakhunov.anton.n, it was disclosed and patched on August 18, 2026. Affected products include Firefox prior to version 154, Firefox ESR prior to 153.1, Thunderbird prior to 154, and Thunderbird ESR prior to 153.1. It carries a CVSS v3.1 base score of 9.1 (High), reflecting network-accessible exploitation with no privileges or user interaction required (Mozilla Advisory, Mozilla Advisory).

The vulnerability is classified as CWE-843 (Access of Resource Using Incompatible Type / 'Type Confusion') within the browser's Service Workers implementation, a component of the DOM that enables background script execution and resource caching across sessions. The flaw allows a malicious website to exploit type confusion in Service Worker handling to circumvent the same-origin policy — the fundamental browser security boundary that prevents cross-origin data access. An attacker can craft a malicious web page that, when visited, registers or manipulates a Service Worker in a way that incorrectly handles resource types, enabling unauthorized access to data or functionality from other origins the user has visited. No authentication or user interaction beyond visiting the malicious page is required for exploitation (Mozilla Advisory, Mozilla Advisory).

Successful exploitation allows an unauthenticated attacker to bypass the same-origin policy, potentially reading sensitive data (e.g., session tokens, cookies, page content) from other origins the victim has visited in the same browser session. The CVSS score reflects high confidentiality and integrity impact with no availability impact, meaning attackers could both read and potentially manipulate cross-origin resources. This could facilitate session hijacking, credential theft, or unauthorized actions on behalf of the user across affected web applications (Mozilla Advisory, Mozilla Advisory).

As of the disclosure date, there is no public proof-of-concept exploit and no evidence of active in-the-wild exploitation (Mozilla Advisory). The EPSS score is reported as 0.0, indicating a currently low probability of exploitation in the near term. The vulnerability is marked as automatable (no user interaction required beyond visiting a malicious page), which increases its theoretical attractiveness to attackers. It is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported.

Mozilla has released patches addressing this vulnerability. Users should update to Firefox 154 or later, Firefox ESR 153.1 or later, Thunderbird 154 or later, or Thunderbird ESR 153.1 or later. No configuration-based workarounds have been published; upgrading to a patched version is the only recommended remediation. Enterprise administrators should prioritize deploying these updates, particularly in environments where users access sensitive web applications (Mozilla Advisory, Mozilla Advisory).