CVE-2026-8962

HighCVSS 8.1/10Last modified Jul 23, 2026

Description

Mitigation bypass in the DOM: Security component. This vulnerability was fixed in Firefox 151, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11.

Metrics

CVSS 3.1 8.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-693

Affected software

No affected versions have been published.

Timeline

Published
May 19, 2026
Last modified
Jul 23, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-896207.8In the Linux kernel, the following vulnerability has been resolved: HID: intel-thc-hid: intel-quickspi: validate report size before copy wCVE-2026-89621In the Linux kernel, the following vulnerability has been resolved: HID: mcp2221: validate report size in mcp2221_raw_event() mcp2221_raw_CVE-2026-896227.8In the Linux kernel, the following vulnerability has been resolved: HID: mcp2221: clear rxbuf after I2C/SMBus transfer completes mcp_i2c_sCVE-2026-89623In the Linux kernel, the following vulnerability has been resolved: HID: mcp2221: stop device IO before hid_hw_stop Quiesce device IO at tCVE-2026-896247.8In the Linux kernel, the following vulnerability has been resolved: HID: universal-pidff: stop the device when force-feedback init fails uCVE-2026-89625In the Linux kernel, the following vulnerability has been resolved: HID: sony: fix UAF of ghl_poke_timer / ghl_urb at driver unbind For GHCVE-2026-896268.8In the Linux kernel, the following vulnerability has been resolved: HID: sensor: custom: Fix field sysfs group cleanup on failure hid_sensCVE-2026-89627In the Linux kernel, the following vulnerability has been resolved: HID: roccat: free buffered reports when destroying device roccat_reporCVE-2026-89628In the Linux kernel, the following vulnerability has been resolved: HID: picolcd: clamp eeprom debugfs read to bytes actually received picCVE-2026-89629In the Linux kernel, the following vulnerability has been resolved: HID: corsair-void: Check size of status and firmware events before readCVE-2026-89637.5Spoofing issue in the Web Speech component. This vulnerability was fixed in Firefox 151 and Thunderbird 151.CVE-2026-896309.1In the Linux kernel, the following vulnerability has been resolved: smb: client: restore the data_offset bound in is_valid_oplock_break()
CVE-2026-8962: High severity, CVSS 8.1 | Vulnix