CVE-2026-100816

This issue involves a site isolation flaw in the DOM networking component of Mozilla Firefox. Based on the description, it is inferred that the flaw can allow malicious web content to read or manipulate resources that should be isolated by the browser’s same‑origin policy, potentially leaking sensitive information or enabling further attacks. The vulnerability is categorized as a site isolation breach, meaning the core separation to protect against cross‑origin data access is weakened.

All Firefox and Thunderbird installations prior to the security release are affected. The fix is provided in Firefox ESR 153.4, the mainstream Firefox 157, and in Thunderbird 153.4 and 157, so versions older than those build numbers are at risk. There is no specific version matrix in the data beyond the upgrade references, but administrators should review their deployed Firefox and Thunderbird releases and ensure they are not using the older ESR or non‑ESR builds that precede 153.4 and 157.

The EPSS score is < 1% and the vulnerability is not listed in CISA’s KEV catalog, so publicly available exploitation data is unknown. Because the flaw compromises a fundamental site isolation mechanism, the potential impact on confidentiality and integrity could be significant if an attacker can host a malicious page. The CVSS score of 8.1 indicates a high severity assessment. Based on the description, it is inferred that the attacker would need to serve malicious web content to the victim, typically by hosting a malicious page or injecting code into a trusted site.