CVE-2026-84133: Vulnerability in Mozilla Firefox

This vulnerability involves a site isolation issue within the DOM Push Subscriptions component in Mozilla Firefox. Site isolation is a security feature designed to separate web content from different origins into separate processes to prevent data leaks and cross-site attacks. The flaw could potentially allow unauthorized access or manipulation of push subscription data. Mozilla fixed this vulnerability in Firefox 155 and Firefox ESR 153.2 as part of a security update addressing multiple high-impact bugs. The CVSS v3.1 base score is 9.8, reflecting network attack vector, low attack complexity, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability.

The vulnerability could allow an attacker to bypass site isolation protections in the DOM Push Subscriptions component, potentially leading to unauthorized access or manipulation of sensitive data. The CVSS score of 9.8 indicates critical impact affecting confidentiality, integrity, and availability. However, there are no known exploits in the wild at this time.

Mozilla has released official fixes for this vulnerability in Firefox 155 and Firefox ESR 153.2. Users and administrators should update to these versions or later to remediate the issue. Since the vulnerability is fixed in these versions, no additional mitigation actions are required beyond applying the update.