CVE-2026-8966 is a high-severity information disclosure vulnerability (CWE-200) affecting the IP Protection component in Mozilla Firefox. It allows unauthorized disclosure of information but does not affect integrity or availability. The vulnerability was fixed in Firefox 151 and Thunderbird 151. The CVSS v3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, indicating network attack vector, low attack complexity, no privileges or user interaction required, and high confidentiality impact. The Mozilla security advisory mfsa2026-46 confirms the fix and provides additional context on related vulnerabilities fixed in the same release.

The vulnerability allows an attacker to disclose sensitive information from the IP Protection component of Firefox, potentially compromising user privacy or security. There is no impact on data integrity or system availability. No known exploits are reported in the wild, reducing immediate risk. However, the high confidentiality impact rating suggests that sensitive information could be exposed if exploited.

This vulnerability is fixed in Mozilla Firefox 151 and Thunderbird 151. Users and administrators should update to these versions or later to remediate the issue. Since this is not a cloud service, patching the client software is required. There is no indication from the vendor advisory that any additional mitigation or temporary workaround is necessary.