CVE-2026-0877 describes a mitigation bypass vulnerability in the DOM security component of Mozilla Firefox. The flaw allows bypassing security mitigations designed to protect the Document Object Model, potentially enabling unauthorized access or manipulation of web content. This vulnerability was fixed in Firefox 147, Firefox ESR 115.32, Firefox ESR 140.7, Thunderbird 147, and Thunderbird 140.7. The CVSS 3.1 base score is 8.1, indicating high severity with network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, and high impact on confidentiality and integrity but no impact on availability.

Successful exploitation of this vulnerability could lead to unauthorized access or manipulation of DOM elements, compromising confidentiality and integrity of user data within the browser context. The CVSS score of 8.1 reflects a high impact, but there are no known exploits in the wild at this time. The vulnerability affects multiple Firefox and Thunderbird versions prior to the fixed releases.

Mozilla has released official fixes for this vulnerability in Firefox 147, Firefox ESR 115.32, Firefox ESR 140.7, Thunderbird 147, and Thunderbird 140.7. Users and administrators should update to these or later versions to remediate the issue. Since this is not a cloud service, patching the client software is required. There are no indications from the vendor advisory that additional mitigations or workarounds are necessary beyond applying the official updates.