PT-2026-24212 · Mozilla · Firefox

Jun Yang · Published 2026-03-10 · Updated 2026-03-19 · CVE-2026-3846

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:C/A:N

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 148.0.2

Description A bypass of the same-origin policy exists in the CSS Parsing and Computation component. This allows potentially malicious actors to circumvent security restrictions designed to isolate web pages from each other.

Recommendations Update Firefox to version 148.0.2 or later.

Fix

Origin Validation Error

Weakness Enumeration

CWE-346

Related Identifiers

BDU:2026-03321

CVE-2026-3846

OPENSUSE-SU-2026:10324-1

Affected Products

Firefox

References · 18

• https://mozilla.org/en-US/security/advisories/mfsa2026-19 · Vendor Advisory
• https://mozilla.org/security/advisories/mfsa2026-19 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-3846 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2026:10324-1 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se47-bulletin-2026-0518SE47 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-3846 · Security Note
• https://ubuntu.com/security/CVE-2026-3846 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-3846 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-03321 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-3846 · Security Note
• https://mozilla.org/en-US/security/advisories/mfsa2026-19/#CVE-2026-3846 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se18-bulletin-2026-0423SE18MD · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-3846 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se17-bulletin-2026-0421SE17 · Vendor Advisory
• https://suse.com/security/cve/CVE-2026-3846 · Note