CVE-2026-74963: 
NixOS vulnerability analysis and mitigation

CVE-2026-74963 is a same-origin policy (SOP) bypass vulnerability in the Networking: Cookies component of Mozilla Firefox and Thunderbird. Discovered and reported by researcher "5up3rh3i," it was publicly disclosed on August 18, 2026, alongside Mozilla's batch security advisories. Affected versions include Firefox prior to 154, Firefox ESR prior to 140.14 and 153.1, Thunderbird prior to 154, and Thunderbird ESR prior to 140.14 and 153.1. It carries a CVSS v3.1 base score of 5.4 (Medium) (Mozilla Advisory, Feedly).

The vulnerability is classified as CWE-346 (Origin Validation Error), meaning the browser's Networking: Cookies component fails to properly validate the origin of cookie-related requests, allowing a malicious page to bypass same-origin policy protections. Exploitation requires network access and user interaction (e.g., visiting a malicious webpage), but no special privileges are needed. The flaw enables an attacker to access or modify cookies belonging to a different origin, circumventing a fundamental browser security boundary. The underlying bug is tracked as Mozilla Bug 2050482, though the full technical details are restricted (Mozilla Advisory, Mozilla Advisory ESR 140.14).

Successful exploitation allows an unauthenticated network attacker to bypass the same-origin policy and read or modify cookies associated with other origins, potentially exposing sensitive session tokens, authentication credentials, or other cookie-stored data. This could enable session hijacking, cross-origin data theft, or unauthorized actions on behalf of the victim user on affected web services. Confidentiality and integrity are both partially impacted, while availability is unaffected (Feedly, Mozilla Advisory).

As of the disclosure date, there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation (Feedly). The EPSS score is reported as 0.0, indicating a currently low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation is not automatable and requires user interaction, reducing the overall risk of mass exploitation.

Mozilla has released patches addressing this vulnerability. Users should update to the following fixed versions immediately:

• Firefox: 154 or later
• Firefox ESR: 140.14 or later (140.x branch), 153.1 or later (153.x branch)
• Thunderbird: 154 or later
• Thunderbird ESR: 140.14 or later, 153.1 or later

No configuration-based workarounds have been published; upgrading to a patched release is the only recommended remediation (Mozilla Advisory, Mozilla Advisory ESR 140.14, Mozilla Advisory ESR 153.1).