CVE-2026-84140: Vulnerability in Mozilla Firefox

CVE-2026-84140 is a security vulnerability in Mozilla Firefox involving a site isolation issue within the DOM Navigation component. Site isolation is a security feature designed to separate different web origins into different processes to prevent data leakage and cross-site attacks. This vulnerability could potentially undermine that isolation, leading to security risks. Mozilla fixed this issue in Firefox 155 and Firefox ESR 153.2 as part of a broader security update addressing multiple high-impact bugs. The CVSS v3.1 base score is 9.8, reflecting network attack vector, low attack complexity, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability. The vendor advisories confirm the fix and recommend upgrading to the patched versions.

The vulnerability impacts the security boundary of site isolation in Firefox's DOM Navigation component, potentially allowing an attacker to bypass isolation protections. This could lead to unauthorized access to sensitive information, privilege escalation, or other high-impact security consequences. The CVSS score of 9.8 indicates critical severity with high impact on confidentiality, integrity, and availability. However, no active exploitation in the wild has been reported at this time.

Mozilla has released official fixes for this vulnerability in Firefox 155 and Firefox ESR 153.2. Users and administrators should update to these versions or later to remediate the issue. Since this is a client software vulnerability, applying the official update is the primary mitigation. There are no vendor advisories indicating that no action is required or that the issue is already mitigated without patching.