CVE-2026-8960: Mozilla Firefox Auth Bypass Vulnerability

CVE-2026-8960 Overview

CVE-2026-8960 is a spoofing vulnerability affecting Mozilla Firefox and Mozilla Thunderbird through the WebExtensions subsystem. The flaw is categorized under [CWE-290] (Authentication Bypass by Spoofing) and allows a network-based attacker to manipulate trusted UI or content surfaces presented through extension APIs. Mozilla addressed the issue in Firefox 151 and Thunderbird 151. The vulnerability requires no privileges and no user interaction, with the primary impact being integrity loss rather than data exposure or service disruption.

Critical Impact
Attackers can exploit the WebExtensions interface to spoof trusted content or extension behavior, undermining user trust decisions in the browser and mail client.

Affected Products

Mozilla Firefox versions prior to 151
Mozilla Thunderbird versions prior to 151
Deployments relying on WebExtensions APIs for security-sensitive UI rendering

Discovery Timeline

2026-05-19 - CVE-2026-8960 published to NVD
2026-05-20 - Last updated in NVD database
Mozilla Advisories - Published as MFSA-2026-46 and MFSA-2026-50

Technical Details for CVE-2026-8960

Vulnerability Analysis

The vulnerability resides in the WebExtensions component shared by Firefox and Thunderbird. WebExtensions provides APIs that extensions use to interact with browser chrome, tabs, and content. A spoofing condition in this layer allows an attacker to present content or extension-mediated interfaces in a way that misrepresents their origin or trust state. Because the issue maps to [CWE-290], the integrity boundary between attacker-controlled content and trusted extension or browser surfaces is broken. The integrity impact is rated high, while confidentiality and availability are unaffected. Mozilla resolved the issue in Firefox 151 and Thunderbird 151 as documented in the Mozilla Bug Report #1940116.

Root Cause

The root cause is improper validation or origin attribution within the WebExtensions handling logic. Trusted UI or API responses can be influenced by attacker-supplied data, enabling a misleading representation that the user or another extension treats as authentic.

Attack Vector

The attack vector is network-based. An attacker hosts crafted web content or a malicious page that triggers the spoofing condition when rendered in a vulnerable Firefox build, or processed by a Thunderbird build using WebExtensions. No authentication or user interaction is required beyond standard browsing or message rendering.

No verified proof-of-concept code is publicly available. Refer to the Mozilla Bug Report #1940116 and the associated security advisories for technical detail as it becomes public.

Detection Methods for CVE-2026-8960

Indicators of Compromise

Firefox or Thunderbird builds reporting versions earlier than 151 in software inventory data
Unexpected installation or update of WebExtensions from untrusted sources
Renderer or extension process activity that originates from suspicious domains shortly before credential or trust-related actions

Detection Strategies

Inventory endpoints to identify Firefox and Thunderbird builds older than 151 using endpoint management or EDR telemetry
Monitor extension manifests and update events for WebExtensions to detect unsigned or sideloaded add-ons
Correlate browser process telemetry with network connections to newly registered or low-reputation domains

Monitoring Recommendations

Enable centralized logging of browser update status and extension installation events
Alert on Firefox or Thunderbird processes loading WebExtensions from non-standard profile paths
Track user-reported phishing or spoofing incidents involving browser or mail client UI

How to Mitigate CVE-2026-8960

Immediate Actions Required

Update Mozilla Firefox to version 151 or later on all managed endpoints
Update Mozilla Thunderbird to version 151 or later on all systems where it is deployed
Audit installed WebExtensions and remove any that are unsigned, unused, or from untrusted publishers

Patch Information

Mozilla released fixes in Firefox 151 and Thunderbird 151. Patch details are available in Mozilla Security Advisory MFSA-2026-46 and Mozilla Security Advisory MFSA-2026-50. Administrators should validate that automatic updates are enabled and that policy-controlled deployments receive the fixed builds.

Workarounds

Restrict WebExtensions installation to an enterprise-approved allowlist using Firefox and Thunderbird enterprise policies
Disable installation of extensions from non-AMO sources where business needs allow
Educate users to verify origin indicators before acting on extension-driven prompts until patching is complete

bash

# Verify installed Firefox version on Linux endpoints
firefox --version

# Verify installed Thunderbird version on Linux endpoints
thunderbird --version

# Example Firefox enterprise policy snippet (policies.json) restricting extensions
# Place under the Firefox distribution directory
# {
#   "policies": {
#     "ExtensionSettings": {
#       "*": { "installation_mode": "blocked" },
#       "approved-extension@example.com": { "installation_mode": "allowed" }
#     }
#   }
# }