CVE-2026-8971: Mozilla Firefox Same-Origin Policy Bypass via JAR URI Null Byte Handling

A same origin policy bypass vulnerability was identified in the Networking: JAR component of Mozilla Firefox. The affected versions fail to reject a null byte (%00) embedded in a jar: or resource:/// URI path before that value reaches downstream filename resolution and content type derivation logic. Because origin and content type attribution for jar: backed resources depend on correctly resolving the inner archive entry name, an unrejected null byte allows the browser to associate one resource's declared identity with content actually served under a different identity.

This is exploitable through two related primitives. First, a crafted jar:file:/// URI can force Firefox to present a completely attacker chosen download filename and extension regardless of the archive's real contents. Second, a null byte placed before a file extension causes Firefox to derive the MIME type from the attacker supplied suffix rather than the actual resource, producing a content type mismatch. Because resource:/// resolves internally to jar:, and moz-extension:// resolves internally to resource:///, the same defect is reachable through any installed browser extension that declares a wildcard entry in web_accessible_resources, extending the practical attack surface from local file URIs to ordinary web content.

This is the third vulnerability in the same root cause chain. CVE-2025-1936 first identified null byte handling issues in JAR entry resolution and was fixed by replacing unsafe C string handling with a length aware string type. CVE-2026-2790 found that a double encoded null byte (%2500) bypassed that fix and was patched by disabling content sniffing for JAR channels entirely. CVE-2026-8971 demonstrates that neither prior fix rejected the null byte at the URL parsing layer itself, leaving the filename resolution and MIME type derivation logic, two further downstream consumers of the same unsanitized value, still exploitable.