Description

Privilege escalation in the DOM: Service Workers component. This vulnerability was fixed in Firefox ESR 153.4, Firefox 157, and Firefox ESR 140.17.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-09-29T13:17:45.803Z",
  "pubdate": "2026-09-29T13:17:45.803Z",
  "executiveSummary": "This vulnerability involves a privilege escalation flaw within the Service Workers component of the Mozilla Firefox browser. Service Workers act as proxy servers that sit between web applications, the browser, and the network, enabling powerful background functionalities like offline caching and push notifications. The vulnerability permits an attacker to bypass standard security boundaries enforced by the Same-Origin Policy (SOP).\nBy exploiting this flaw, an unauthorized actor can gain elevated privileges within the context of the browser, potentially leading to arbitrary code execution or unauthorized access to sensitive user data managed by the browser process. The vulnerability affects Firefox, Firefox ESR 153.4, and Firefox ESR 140.17. Successful exploitation requires a victim to interact with a malicious web resource, but does not strictly require prior authentication. The security implications are critical, as it undermines the core isolation mechanisms that protect web application data from cross-site interference. Users are urged to upgrade to the specified patched versions immediately to mitigate the risk of browser compromise.",
  "technicalDetails": "The vulnerability resides in the Service Workers implementation, specifically within the orchestration of background event handling and the registration process. Service Workers are designed to operate in an isolated environment, separate from the primary web page execution context. This isolation is governed by strict security checks to ensure that a Service Worker cannot interfere with or access data from origins other than its own.\nThe root cause of this privilege escalation is an improper validation of the origin scoping mechanism during the Service Worker installation or update sequence. An attacker can craft a malicious script that forces the browser to misassociate a Service Worker registration with a different, more privileged origin or internal browser context. By manipulating the Service Worker's scope property, an attacker can trick the browser into executing script code within an elevated security context.\nThe exploitation flow typically follows these steps: 1) The attacker hosts a malicious document designed to trigger an error or race condition during the Service Worker registration lifecycle. 2) The browser's Service Worker controller fails to correctly verify the origin boundary, allowing the attacker to inject unauthorized script routines into the Service Worker cache or background process. 3) Upon activation, the Service Worker executes the malicious payload with the elevated privileges of the target scope. 4) The attacker leverages this elevated access to perform unauthorized operations, such as modifying the DOM of cross-origin pages, intercepting network requests, or exfiltrating sensitive cookies and session tokens.\nThis flaw effectively bypasses the Same-Origin Policy, as it allows for cross-origin script execution. Because the Service Worker runs in a separate thread and maintains persistence even after the closing of the triggering tab, the impact can be significant. The vulnerability is exploitable via remote web content, meaning that any user browsing to a malicious site could potentially trigger the exploit without requiring administrative privileges on the host operating system. The technical complexity lies in the timing of the registration request relative to the browser’s internal security object lifecycle, which, if mishandled, creates a temporary window where security constraints are not enforced."
}