CVEFinder.io

CVE-2026-8964

⚠️ high
🔍 Scan for this CVE
Summary

Spoofing issue in the Popup Blocker component. This vulnerability was fixed in Firefox 151 and Thunderbird 151.

CVSS Score
7.5
High
EPSS Score
0.3
Exploit Probability
Published Date
2026-05-19
First Seen: 2026-05-20
📊 Relative Risk Intelligence

This CVE is Moderate Risk - more severe than 67.7% of all 365,646 vulnerabilities in our database.

#117,948
Above average severity
Severity Percentile
🎯 CISA SSVC Assessment Updated: May 19, 2026
🔍 Exploitation Status
None
No known exploits
⚙️ Automatable
YES
Can be exploited automatically
💥 Technical Impact
Partial
Limited system impact
🏆 Discovered By
Satoki Tsuji
SSVC data provided by CISA
Last Modified 2026-07-23
Source NVD 🔗
CVSS Vector 3.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
CWE IDs (Weakness Types)
CWE-451

📦 Affected Products 2

Vendor Product Status Affected Versions
mozilla firefox Affected
< 151.0.0
mozilla thunderbird Affected
< 151.0.0

🔗 References 3

https://bugzilla.mozilla.org/show_bug.cgi?id=2025170
Permissions Required
https://www.mozilla.org/security/advisories/mfsa2026...
Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2026...
Vendor Advisory

🔗 Related CVEs 6

CVE ID Severity CVSS EPSS Summary Published
CVE-2026-100756 ⚠️ high 8.1 0.3 Incorrect boundary conditions in the Audio/Video: Playback component. This vulnerability was fixed in Firefox ESR 153.4,... 2026-09-29
CVE-2026-100767 ⚠️ high 8.8 0.3 Use-after-free in the Networking: Cache component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, T... 2026-09-29
CVE-2026-100768 ⚠️ high 8.8 0.3 Use-after-free in the Graphics: WebGPU component. This vulnerability was fixed in Thunderbird 157 and Firefox 157. 2026-09-29
CVE-2026-100769 ⚠️ high 8.8 0.3 Use-after-free in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird ... 2026-09-29
CVE-2026-100770 ⛔ critical 9.6 0.3 Sandbox escape due to use-after-free in the DOM: Content Processes component. This vulnerability was fixed in Firefox ES... 2026-09-29
CVE-2026-100771 ⚠️ high 8.1 0.3 Undefined behavior in the DOM: Streams component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Th... 2026-09-29
These CVEs affect the same products