CVE-2026-0877 is a mitigation bypass vulnerability in the DOM security component of Mozilla Firefox. It affects Firefox versions before 147 and Firefox ESR versions before 115.32. The vulnerability was addressed and fixed in Firefox 147 and Firefox ESR 115.32. The CVSS 3.1 base score is 8.1, indicating high severity, with network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, and high impact on confidentiality and integrity but no impact on availability. The vulnerability is tracked under CWE-693. Multiple Mozilla security advisories confirm the fix and provide detailed references. Red Hat advisories also address this vulnerability in their distributions.

Successful exploitation of this vulnerability could allow an attacker to bypass mitigation controls in the DOM security component, potentially leading to unauthorized access or manipulation of sensitive information within the browser context. The CVSS score of 8.1 reflects a high impact on confidentiality and integrity. There is no reported impact on availability. No known exploits in the wild have been reported, but the vulnerability poses a significant risk if left unpatched.

This vulnerability has been fixed in Firefox 147, Firefox ESR 115.32, Firefox ESR 140.7, Thunderbird 147, and Thunderbird 140.7. Users and administrators should update affected Firefox and Thunderbird versions to these fixed releases or later. Since this is not a cloud service, remediation depends on applying these official vendor patches. Check the Mozilla security advisories for the latest updates and confirm patch application. No additional mitigation steps are indicated beyond applying the official fixes.