CVE-2026-84139: Vulnerability in Mozilla Firefox

CVE-2026-84139 is a clickjacking vulnerability affecting the DOM: Events component in Mozilla Firefox. Clickjacking allows an attacker to trick users into clicking on something different from what the user perceives, potentially leading to unauthorized actions. This vulnerability was fixed in Firefox 155 and Firefox ESR 153.2. The CVSS v3.1 base score is 9.8 (critical), with attack vector network, low attack complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. The Mozilla advisories MFSA2026-82 and MFSA2026-85 confirm the fix and provide additional context on related vulnerabilities fixed in these releases.

If exploited, this vulnerability could allow an attacker to perform unauthorized actions by tricking users through clickjacking, potentially compromising user data and system integrity. The CVSS score of 9.8 reflects critical severity with high impact on confidentiality, integrity, and availability. However, no active exploits have been reported in the wild.

Mozilla has fixed this vulnerability in Firefox 155 and Firefox ESR 153.2. Users and administrators should update affected Firefox installations to these versions or later to mitigate the risk. Since the vulnerability is fixed, no additional mitigation steps are required beyond applying the official update.