CVE-2026-8948 is a same-origin policy bypass vulnerability in the DOM Networking component of Mozilla Firefox. The same-origin policy is a critical security mechanism that restricts how documents or scripts loaded from one origin can interact with resources from another origin. Bypassing this policy can lead to unauthorized access to sensitive information or manipulation of web content. This vulnerability affects Firefox versions prior to 151 and was fixed in Firefox 151 as well as Thunderbird 151. The vulnerability has a CVSS v3.1 base score of 9.1, reflecting its critical impact on confidentiality and integrity without requiring user interaction or privileges. Mozilla's official security advisory MFSA2026-46 details the fix and related vulnerabilities addressed in Firefox 151.

Successful exploitation of this vulnerability could allow an attacker to bypass the same-origin policy, potentially leading to unauthorized access to sensitive information or manipulation of web content from different origins. The CVSS score of 9.1 indicates a critical impact on confidentiality and integrity. There is no indication of impact on availability. No known exploits in the wild have been reported, but the vulnerability poses a significant risk if left unpatched.

Mozilla has fixed this vulnerability in Firefox 151 and Thunderbird 151. Users and administrators should update affected products to version 151 or later to remediate this issue. Since this is an official fix from the vendor, applying the update fully mitigates the vulnerability. Patch status is confirmed by the vendor advisory MFSA2026-46. No additional mitigation steps are required beyond applying the official update.