CVE-2026-84129: Vulnerability in Mozilla Firefox

CVE-2026-84129 is a security vulnerability affecting the site isolation mechanism in the DOM Navigation component of Mozilla Firefox. Site isolation is a security feature designed to separate web content from different origins into different processes to prevent cross-site attacks. This vulnerability could undermine that isolation, potentially allowing unauthorized access or manipulation of content across site boundaries. The flaw was identified and fixed in Firefox 155 and Firefox ESR 153.2. The vulnerability is tracked under CWE-346 (Origin Validation Error) and has a CVSS v3.1 score of 9.8, reflecting critical severity with network attack vector, low attack complexity, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability.

The vulnerability impacts the security boundary enforced by site isolation in Firefox, potentially allowing an attacker to bypass origin-based restrictions in the DOM Navigation component. This could lead to unauthorized access to sensitive information, privilege escalation, or other high-impact security breaches. The CVSS score of 9.8 indicates critical impact on confidentiality, integrity, and availability. No known exploits in the wild have been reported at the time of publication.

Mozilla has released official fixes for this vulnerability in Firefox 155 and Firefox ESR 153.2. Users and administrators should update to these versions or later to remediate the issue. Since this is not a cloud service, remediation depends on applying these updates. Patch status is confirmed by the vendor advisories. No additional mitigation steps are indicated beyond applying the official updates.