CVE-2026-84137: Vulnerability in Mozilla Firefox

CVE-2026-84137 is a spoofing vulnerability affecting the DOM: Core & HTML component in Mozilla Firefox. It was identified internally and fixed in Firefox 155 and Firefox ESR 153.2. The vulnerability allows an attacker to potentially spoof content, impacting the security of the browser. The CVSS v3.1 score is 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating network attack vector, low attack complexity, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability. The Mozilla advisories mfsa2026-82 and mfsa2026-85 provide detailed information and confirm the remediation in the stated versions.

The vulnerability allows an attacker to spoof content within the browser's DOM Core and HTML components, potentially leading to high impact on confidentiality, integrity, and availability of the affected system. Given the critical CVSS score of 9.8, exploitation could result in significant compromise if unpatched. However, no known exploits in the wild have been reported at this time.

Mozilla has fixed this vulnerability in Firefox 155 and Firefox ESR 153.2. Users and administrators should update to these versions or later to mitigate the risk. Since the vulnerability is fixed in these releases, no additional mitigation steps are required beyond applying the official updates.