CVE-2026-0883

Vulnerability

Overview

CVE-2026-0883 is an information disclosure vulnerability in the Networking component of Mozilla products. The flaw was reported by Vladislav Plyatsok and is tracked as bug 1989340 [1][2]. It affects Firefox, Firefox ESR, and Thunderbird, allowing an attacker to potentially leak sensitive data through the networking stack.

Exploitation

Context

The vulnerability exists in the Networking component, which handles network requests and responses. In Thunderbird, exploitation through email is not feasible because scripting is disabled when reading mail [1][3]. However, in browser or browser-like contexts (e.g., Firefox or Thunderbird with active content), an attacker could potentially trigger the flaw without requiring authentication or user interaction beyond normal browsing.

Impact

A successful exploit could lead to information disclosure, exposing sensitive data that should be protected. The CVSS v3 severity is Medium (5.3), and the advisory rates the impact as moderate [1][2]. The attacker cannot execute arbitrary code but may gain access to information such as HTTP headers, cookies, or other networking data.

Mitigation

Mozilla has addressed this vulnerability in Firefox 147, Firefox ESR 140.7, Thunderbird 147, and Thunderbird 140.7, released on January 13, 2026 [1][2][3][4]. Users should update to these patched versions immediately to mitigate the risk.