Cookie security bypass via case-sensitive prefix checks

Improper case handling in Firefox before 127 allows remote attackers to bypass cookie-prefix protections via crafted Set-Cookie headers. The cookie parser compares the __Secure- and __Host- prefixes case-sensitively, so miscapitalized names bypass required security checks. A site able to set such a cookie can make a case-insensitive server treat it as protected even though Firefox accepted it without the required attributes.