CVE-2026-4700

CVE-2026-4700 is a mitigation bypass vulnerability in the Networking: HTTP component of Mozilla Firefox and Thunderbird. It affects versions of Firefox prior to 149, Firefox ESR prior to 140.9, Thunderbird prior to 149, and Thunderbird prior to 140.9. The issue is classified under CWE-288 (Authentication Bypass Using an Alternate Path or Channel) with a CVSS v3.1 base score of 9.8, indicating critical severity due to its network accessibility, low complexity, lack of required privileges or user interaction, and high impacts on confidentiality, integrity, and availability.

Any unauthenticated remote attacker can exploit this vulnerability over the network with low complexity and no user interaction. Successful exploitation allows the attacker to bypass security mitigations in the HTTP networking stack, potentially leading to arbitrary code execution, data theft, or system compromise on affected browsers or email clients.

Mozilla security advisories (MFSA 2026-20, 22, 23, 24) and the associated Bugzilla entry (2003766) confirm the vulnerability was addressed in the specified fixed releases. Mitigation requires updating to Firefox 149, Firefox ESR 140.9, Thunderbird 149, or Thunderbird 140.9, with no additional workarounds mentioned.