CVE-2026-100808

Based on the description, this vulnerability allows an attacker to bypass security mitigations that apply to Service Worker functionality in the DOM. This could enable the execution of malicious scripts or the unauthorized use of privileged resources in the context of a Service Worker, thereby eroding the isolation guarantees normally provided. The precise operational impact remains unspecified, but the loss of mitigation controls could allow broader access to sensitive information or actions.

Mozilla Firefox and Mozilla Thunderbird are affected. Builds of Firefox before ESR 153.4 or version 157, and Thunderbird before ESR 153.4 or version 157, contain the flaw. Users running those earlier releases are at risk.

The affected systems are client‑side applications. The EPSS score of < 1% indicates a very low, non‑zero probability of exploitation, and the vulnerability is not in the CISA KEV catalog. The CVSS score of 8.8 indicates high severity. The attack vector is likely a malicious website that a user visits with an affected Firefox or Thunderbird build. Because the CVE description does not provide exploitation details or proof‑of‑concept, the exact capabilities obtainable by an attacker remain unspecified.