CVE-2026-74963: Mozilla Firefox Same-Origin Policy Bypass in Cookie Engine

HERMES

HERMES THREAT SCORE & CROSS-ORIGIN PRIVACY VIOLATION

Target: Mozilla Firefox Cookie Storage & Transmission Subsystem

Confidence: 96%

70 / 100

MEDIUM

Measures real-world operational relevance, exploit weaponization, and active threat posture.

Dimension Breakdown

Exploitability 16 / 20

Threat Activity 12 / 20

Weaponization 14 / 20

Exposure 16 / 20

Prevalence 20 / 20

Impact 14 / 20

Exploit Maturity 13 / 20

Attack Chain Potential 16 / 20

⚖️ Divergence & Operational Rationale

Hermes evaluates CVE-2026-74963 at HTS 70 (Medium). Bypassing the Same-Origin Policy for HTTP cookies enables cross-site account takeover and unauthorized session resumption across distinct origins.

🕸️ Connected Knowledge Graph & Provenance

CVE-2026-74963: Mozilla Firefox Same-Origin Policy Bypass in Cookie EngineVULNERABILITY

Connected Nodes: 0

Same-Origin Policy Bypass in Cookie Handling

CVSS v3.1: 5.4 Medium / 6.5 Adjusted (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N) / CWE-346: Origin Validation Error.
Disclosed by Mozilla. A flaw in cookie scope parsing allows an attacker who controls a subdomain or related origin to access or tamper with cookies scoped to different origins, undermining session integrity. Addressed in Firefox 154.

Executive Summary

Mozilla resolved CVE-2026-74963, a same-origin validation error in the browser network layer.

Inconsistencies between public suffix list processing and cookie domain attribute handling enabled hostile web origins to capture session cookies belonging to sibling domains.

---

1. Metadata & Remediation

Metric	Technical Specification	Operational Impact
CVE Identifier	CVE-2026-74963	Standardized vulnerability identifier
Affected Subsystem	Networking: Cookies	Browser state & credential storage
Fixed Release	Firefox 154	Official patch release
Associated CWE	CWE-346: Origin Validation Error	Cookie privacy & isolation failure

1. Upgrade Firefox: Apply update to Firefox 154 or higher.
2. Web Application Hardening: Ensure sensitive session cookies set the __Host- prefix and SameSite=Strict flag.