CVE-2026-4700: Mitigation bypass in the Networking: HTTP component
Vulnerability summary
CVE-2026-4700 is a critical (CVSS 9.8) vulnerability in mozilla firefox. EPSS estimates a 0.92% chance of exploitation in the next 30 days, higher than 60.2% of scored vulnerabilities.
Severe, CVSS 9.8 (CVE.org); no exploitation reported by the 5 checked sources; EPSS 1% (FIRST, 03-11-2026)
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 39 · Related 9Timeline
- 24-03-2026PublishedVulnerability first disclosed.
- 15-07-2026Last modifiedVulnerability information updated.
Description
Mitigation bypass in the Networking: HTTP component. This vulnerability was fixed in Firefox 149, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9.
CVSS metrics
4 scores · 4 sources · 1 version- OSV · UbuntuEcosystem advisory · calculated9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- NVDNIST9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
0.92%
Chance of exploitation in the next 30 days
Percentile
60%
Versus all other CVEs
30-day change
Increase +0.46 pp
From 0.46% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-288Authentication Bypass Using an Alternate Path or ChannelThe product requires authentication, but the product has an alternate path or channel that does not require authentication.
- CWE-444Inconsistent Interpretation of HTTP RequestsThe product acts as an intermediary HTTP agent (such as a proxy or firewall) in the data flow between two entities such as a client and server, but it does not interpret malformed HTTP requests or responses in ways that are consistent with how the messages will be processed by those entities that are at the ultimate destination.
Affected systems
Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.
Ubuntu8 products
- mozjs102All versions (No fix recorded)
- mozjs115All versions (No fix recorded)
- mozjs38All versions (No fix recorded)
- mozjs52All versions (No fix recorded)
- mozjs68All versions (No fix recorded)
Chainguard2 products
- firefox< 149.0-r0
- firefox-esr< 140.9.0-r0
Debian2 products
- firefox-esr< 140.9.0esr-1~deb12u1 | < 140.9.0esr-1~deb13u1 | < 140.9.0esr-1
- thunderbird< 1:140.9.0esr-1~deb12u1 | < 1:140.9.0esr-1~deb13u1 | < 1:140.9.0esr-1
Mozilla1 product
- firefox< 140.9.0 | < 149.0
Wolfi1 product
- firefox< 149.0-r0
5 vendors · 14 products
