Cross-site data leakage via wrong CORS principal

Same-origin policy bypass in Mozilla Firefox and Thunderbird allows remote attackers to leak cross-site data through crafted web content. The Layout code checks a cross-origin CSS mask-image request against the stylesheet's triggering principal instead of the page's loading principal, accepting an image origin that trusts the stylesheet but not the embedding page. Exploitation requires a permitted cross-origin stylesheet that references a third-origin mask image; Thunderbird mail reading disables scripting, limiting exposure to browser-like contexts.