Loading vulnerability…
Same-Origin Policy Bypass in Mozilla Networking Cookies
CVE-2026-12304 is a same-origin policy bypass in the Networking: Cookies component of Mozilla Firefox and Thunderbird. The flaw can bypass cross-origin security restrictions and potentially enable unauthorized access to data or actions across origins. It was fixed in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird ESR 140.12.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can bypass the same-origin policy, potentially allowing unauthorized cross-origin access to data or actions.
If you can’t patch tonight, do this now.
No vulnerability-specific workaround or temporary mitigation is provided. Promptly apply the applicable Mozilla security update.
Patch, then assume compromise.
Upgrade affected products to fixed releases: Firefox 152 or later, Firefox ESR 140.12 or later, Thunderbird 152 or later, or Thunderbird ESR 140.12 or later. On Debian stable (trixie), upgrade firefox-esr to version 140.12.0esr-1~deb13u1.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
16 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.