CVE-2026-74963: Mozilla Firefox Auth Bypass Vulnerability

CVE-2026-74963 Overview

CVE-2026-74963 is a same-origin policy bypass in the Networking: Cookies component of Mozilla Firefox and Thunderbird. The flaw permits cross-origin interaction with cookies that should remain isolated to their originating site. Mozilla addressed the issue in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1. Exploitation requires user interaction, such as visiting an attacker-controlled page. The vulnerability maps to CWE-346: Origin Validation Error.

Critical Impact
An attacker-controlled web page can bypass same-origin restrictions on cookies, exposing limited confidentiality and integrity of session data across origins.

Affected Products

Mozilla Firefox before version 154
Mozilla Firefox ESR before 140.14 and 153.1
Mozilla Thunderbird before 154, 140.14, and 153.1

Discovery Timeline

2026-08-18 - CVE-2026-74963 published to the National Vulnerability Database
2026-08-19 - Last updated in NVD database

Technical Details for CVE-2026-74963

Vulnerability Analysis

The defect resides in Firefox's Networking: Cookies subsystem, which enforces the same-origin policy (SOP) for cookie storage and retrieval. Improper origin validation lets a foreign origin observe or influence cookies that belong to a different site. An attacker leverages this by luring a user to a malicious page that triggers the flawed cookie handling path. Successful exploitation yields limited access to authentication or state data tied to a targeted origin, potentially aiding session tracking or targeted phishing. Because Thunderbird reuses the Gecko engine, remote content rendering in email exposes the same code path.

Root Cause

The underlying defect is an origin validation error [CWE-346] in the cookie handling logic. Cookie access decisions do not correctly bind requests to their originating security context. As a result, the browser treats cross-origin cookie operations as same-origin under specific conditions.

Attack Vector

Exploitation is network-based and requires user interaction, typically by visiting a crafted web page or previewing HTML email content in Thunderbird. No prior authentication or elevated privileges are required. The scope of impact is limited to confidentiality and integrity of cookie-scoped data. See the Mozilla Security Advisory MFSA-2026-74 and Mozilla Bug 2050482 for further technical context.

Detection Methods for CVE-2026-74963

Indicators of Compromise

Endpoint telemetry showing Firefox or Thunderbird versions below the fixed releases (154, ESR 140.14, ESR 153.1) still in production use.
Web proxy logs containing unusual cross-origin requests to authentication endpoints originating from suspicious referrers.
Repeated cookie-bearing requests to sensitive domains that lack a matching same-origin navigation.

Detection Strategies

Inventory installed browser and mail client versions across managed endpoints and flag any build older than the Mozilla-fixed releases.
Correlate browser process activity with outbound HTTP requests to detect anomalous cross-origin cookie transmission.
Monitor Thunderbird remote-content loads and alert on external HTTP requests generated from message preview contexts.

Monitoring Recommendations

Ingest browser and endpoint logs into a centralized data lake to enable version drift alerting for Firefox and Thunderbird.
Track Mozilla advisories MFSA-2026-74 through MFSA-2026-80 for related fixes bundled in the same release cycle.
Alert on user reports of unexpected re-authentication prompts or session anomalies on high-value web applications.

How to Mitigate CVE-2026-74963

Immediate Actions Required

Update Firefox to version 154 or later on all managed endpoints.
Update Firefox ESR deployments to 140.14 or 153.1, depending on the branch in use.
Update Thunderbird to 154, 140.14, or 153.1 to remediate the same defect in the mail client.
Prioritize systems where users handle authenticated sessions to sensitive applications from within Thunderbird or Firefox.

Patch Information

Mozilla fixed CVE-2026-74963 in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1. Refer to the vendor advisories: MFSA-2026-74, MFSA-2026-76, MFSA-2026-77, MFSA-2026-78, MFSA-2026-79, and MFSA-2026-80.

Workarounds

Disable remote content loading in Thunderbird message previews until endpoints are patched.
Enforce enterprise policies that block navigation to untrusted sites and restrict third-party cookies where feasible.
Use browser management tooling to require automatic updates for Firefox and Thunderbird across the fleet.

bash

# Enterprise policy example: enforce automatic updates and block third-party cookies
# /etc/firefox/policies/policies.json
{
  "policies": {
    "DisableAppUpdate": false,
    "AppAutoUpdate": true,
    "Cookies": {
      "AcceptThirdParty": "never",
      "Default": true
    }
  }
}