CVE-2026-12304: Same-origin policy bypass in the Networking: Cookies component

Synopsis

A same-origin policy bypass in the Networking: Cookies component of Mozilla Firefox and Thunderbird allows a remote, unauthenticated attacker to exploit the flaw over the network without any user interaction. Successful exploitation gives the attacker read and write access to cookie data that should be isolated by origin boundaries, enabling session hijacking, credential theft, and cross-site data manipulation. Patched-image rebuilds at Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12 are available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the affected Firefox or Thunderbird instance over the network, as the attack vector is Network (AV:N).

• AuthenticationNot required

  No account or session credential is needed before exploitation; the vulnerability is reachable by any unauthenticated party (PR:N).

• Victim interactionNot required

  Exploitation does not require the user to click a link, open a file, or take any other action; the attack proceeds without user interaction (UI:N).

• Attack complexityDetail

  Attack complexity is Low (AC:L), meaning the exploit is reliable and requires no special conditions, race timing, or environmental prerequisites.

Blast Radius

• A successful attacker reads cookie values across origin boundaries, enabling theft of session tokens and authentication cookies scoped to other sites.
• The attacker writes or overwrites cookies for foreign origins, allowing session fixation attacks or poisoning of cookie-based application state.
• Cross-origin cookie access exposes any credential, preference, or tracking data stored in cookies by co-hosted or visited web applications.