CVE-2026-2790 is a high-severity vulnerability affecting Mozilla Firefox's Networking: JAR component, allowing a same-origin policy bypass. The same-origin policy is a critical security mechanism that restricts how documents or scripts loaded from one origin can interact with resources from another origin. Bypassing this policy can lead to unauthorized access or manipulation of data across origins. Mozilla fixed this issue in Firefox 148 and Firefox ESR 140.8, as documented in their security advisories. The vulnerability has a CVSS 3.1 score of 8.8, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, and high impact on confidentiality, integrity, and availability.

Successful exploitation of this vulnerability could allow an attacker to bypass the same-origin policy, potentially leading to unauthorized access to sensitive information or manipulation of web content across origins. This could compromise confidentiality, integrity, and availability of affected systems. However, there are no reports of active exploitation in the wild. The impact is mitigated by the availability of fixed versions of Firefox and Firefox ESR.

Mozilla has released official fixes for this vulnerability in Firefox 148 and Firefox ESR 140.8. Users and administrators should update affected Firefox installations to these versions or later to remediate the vulnerability. No additional mitigation actions are required beyond applying the official patches.