CVE-2026-12304: Mozilla Firefox Cross-Origin Cookie Leakage & SOP Bypass

HERMES

HERMES THREAT SCORE & CROSS-DOMAIN COOKIE EXPOSURE

Target: Mozilla Firefox Cookie Storage & Scope Validation Subsystem

Confidence: 96%

72 / 100

MEDIUM

Measures real-world operational relevance, exploit weaponization, and active threat posture.

Dimension Breakdown

Exploitability 17 / 20

Threat Activity 13 / 20

Weaponization 15 / 20

Exposure 17 / 20

Prevalence 20 / 20

Impact 14 / 20

Exploit Maturity 14 / 20

Attack Chain Potential 17 / 20

⚖️ Divergence & Operational Rationale

Hermes rates CVE-2026-12304 at HTS 72 (Medium). Cookie isolation is fundamental to web application session security. Exploiting scope confusion across sibling domains enables attackers to steal sensitive corporate session tokens.

🕸️ Connected Knowledge Graph & Provenance

CVE-2026-12304: Mozilla Firefox Cross-Origin Cookie Leakage & SOP BypassVULNERABILITY

Connected Nodes: 0

Same-Origin Policy Bypass in Cookie Scoping

CVSS v3.1: 6.5 Medium (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) / CWE-346: Origin Validation Error.
Disclosed by Mozilla. A vulnerability in cookie domain scope evaluation allows a malicious cross-origin website to read session cookies set by other origins sharing a common domain suffix, leading to account impersonation. Addressed in Firefox 152 and Firefox ESR 140.12.

---

1. Metadata & Hardening

Metric	Technical Specification	Operational Impact
CVE Identifier	CVE-2026-12304	Standardized vulnerability identifier
Affected Component	Networking: Cookies	Browser cookie store
Fixed Releases	Firefox 152, Firefox ESR 140.12	Official security release
Associated CWE	CWE-346: Origin Validation Error	Cookie domain boundary bypass

1. Apply Browser Upgrade: Update Firefox to 152 or Firefox ESR 140.12.
2. Session Security Hardening: Web applications must mandate Secure, HttpOnly, and SameSite=Strict on critical authentication cookies.