CVE-2026-3846
published 2026-03-10CVE-2026-3846: Same-origin policy bypass in the CSS Parsing and Computation component. This vulnerability was fixed in Firefox 148.0.2.
PriorityP431medium6.5CVSS 3.1
AVNACLPRNUIRSUCNIHAN
EPSS
0.11%
1.6th percentile
Same-origin policy bypass in the CSS Parsing and Computation component. This vulnerability was fixed in Firefox 148.0.2.
Affected
7 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| craftcms | cms | >= 4.0.0-RC1 < 4.17.5 | 4.17.5 |
| craftcms | cms | >= 5.0.0-RC1 < 5.9.11 | 5.9.11 |
| craftcms | cms | >= 5.6.0 < 5.9.13 | 5.9.13 |
| craftcms | cms | >= 5.6.0 < 5.9.11 | 5.9.11 |
| debian | firefox | < firefox 148.0.2-1 (sid) | firefox 148.0.2-1 (sid) |
| mozilla | firefox | < 148.0.2 | 148.0.2 |
| mozilla | firefox | — | — |
CVSS provenance
nvdv3.16.5MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
osv6.5MEDIUM
vendor_debian6.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Debian
CVE-2026-3846: firefox - Same-origin policy bypass in the CSS Parsing and Computation component. This vul...
vendor_debian·2026·CVSS 6.5
CVE-2026-3846 [MEDIUM] CVE-2026-3846: firefox - Same-origin policy bypass in the CSS Parsing and Computation component. This vul...
Same-origin policy bypass in the CSS Parsing and Computation component. This vulnerability affects Firefox < 148.0.2.
Scope: local
sid: resolved (fixed in 148.0.2-1)
Mozilla
Mozilla Foundation Security Advisory 2026-19: CVE-2026-3846
vendor_mozilla·CVSS 6.5
CVE-2026-3846 [MEDIUM] Mozilla Foundation Security Advisory 2026-19: CVE-2026-3846
Mozilla Foundation Security Advisory 2026-19
CVE: CVE-2026-3846
Product: Firefox
Impact: high
Fixed in: Firefox 148.0.2
GHSA
Craft CMS is Vulnerable to Authenticated Remote Code Execution via Malicious Attached Behavior
ghsa·2026-03-24
CVE-2026-33157 [HIGH] CWE-470 Craft CMS is Vulnerable to Authenticated Remote Code Execution via Malicious Attached Behavior
Craft CMS is Vulnerable to Authenticated Remote Code Execution via Malicious Attached Behavior
## Summary
A Remote Code Execution (RCE) vulnerability exists in Craft CMS 5.x and 4.x that bypasses the security fixes for GHSA-7jx7-3846-m7w7 and GHSA-255j-qw47-wjh5. This vulnerability can be exploited by any authenticated user with control panel access.
The existing patches add `cleanseConfig()` to `assembleLayoutFromPost()` and various `FieldsController` actions to strip Yii2 behavior/event injection keys (`as ` and `on ` prefixed keys). However, the `fieldLayouts` parameter in `ElementIndexesController::actionFilterHud()` is passed directly to `FieldLayout::createFromConfig()` without any sanitization, enabling the same behavior injection attack chain.
## Impact
- **Attack Type**: Remo
GHSA
Craft CMS vulnerable to behavior injection RCE via EntryTypesController
ghsa·2026-03-16
CVE-2026-32263 [HIGH] CWE-470 Craft CMS vulnerable to behavior injection RCE via EntryTypesController
Craft CMS vulnerable to behavior injection RCE via EntryTypesController
The fix for GHSA-7jx7-3846-m7w7 (commit 395c64f0b80b507be1c862a2ec942eaacb353748) only patched `src/services/Fields.php`, but the same vulnerable pattern exists in `EntryTypesController::actionApplyOverrideSettings()`.
In `src/controllers/EntryTypesController.php` lines 381-387:
```php
$settingsStr = $this->request->getBodyParam('settings');
parse_str($settingsStr, $postedSettings);
$settingsNamespace = $this->request->getRequiredBodyParam('settingsNamespace');
$settings = array_filter(ArrayHelper::getValue($postedSettings, $settingsNamespace, []));
if (!empty($settings)) {
Craft::configure($entryType, $settings);
```
The `$settings` array from `parse_str` is passed directly to `Craft::configure()` without `Compon
GHSA
Craft CMS vulnerable to behavior injection RCE ElementIndexesController and FieldsController
ghsa·2026-03-16
CVE-2026-32264 [HIGH] CWE-470 Craft CMS vulnerable to behavior injection RCE ElementIndexesController and FieldsController
Craft CMS vulnerable to behavior injection RCE ElementIndexesController and FieldsController
The fix for https://github.com/advisories/GHSA-7jx7-3846-m7w7 (commit https://github.com/craftcms/cms/commit/395c64f0b80b507be1c862a2ec942eaacb353748) only patched `src/services/Fields.php`, but the same vulnerable pattern exists in `ElementIndexesController` and `FieldsController`.
You need Craft control panel administrator permissions, and allowAdminChanges must be enabled for this to work.
An attacker can use the same gadget chain from the original advisory to achieve RCE.
Users should update to Craft 4.17.5 and 5.9.11 to mitigate the issue.
OSV
CVE-2026-3846: Same-origin policy bypass in the CSS Parsing and Computation component
osv·2026-03-10·CVSS 6.5
CVE-2026-3846 [MEDIUM] CVE-2026-3846: Same-origin policy bypass in the CSS Parsing and Computation component
Same-origin policy bypass in the CSS Parsing and Computation component. This vulnerability affects Firefox < 148.0.2.
GHSA
GHSA-hpw7-hx42-jvqq: Same-origin policy bypass in the CSS Parsing and Computation component
ghsa_unreviewed·2026-03-10
CVE-2026-3846 [MEDIUM] CWE-346 GHSA-hpw7-hx42-jvqq: Same-origin policy bypass in the CSS Parsing and Computation component
Same-origin policy bypass in the CSS Parsing and Computation component. This vulnerability affects Firefox < 148.0.2.
No detection rules found.
No public exploits indexed.
2026-03-10
Published