Same-origin Policy Bypass in Firefox Audio/Video Component
CVE-2026-74967

Currently unrated

Key Information:

Vendor: Mozilla
Status: Firefox
Vendor: CVE Published:; 18 August 2026

What is CVE-2026-74967?

A same-origin policy bypass vulnerability exists in the Audio/Video: Playback component of Firefox, which could allow an attacker to exploit this weakness to access potentially sensitive data across different origins. This flaw has been addressed in the updates for Firefox 154 and its Extended Support Release (ESR) variants, ensuring that users are protected from potential attacks leveraging this vulnerability.

Affected Version(s)

Firefox 140.14

Firefox 153.1

Firefox 154

References

https://bugzilla.mozilla.org/show_bug.cgi?id=2055697

https://www.mozilla.org/security/advisories/mfsa2026-74/

https://www.mozilla.org/security/advisories/mfsa2026-76/

Download the Critical Vulnerability Management Cheat Sheet

Timeline

Vulnerability published
Aug 18, 2026
Vulnerability Reserved
Aug 17, 2026

Credit

The Mozilla Fuzzing Team

CVE-2026-74967 Data

JSON