Mozjs52: [Unknown description] (CVE-2026-84140)

CVE-2026-84140 is identified as a site isolation issue in the DOM: Navigation component of Firefox, fixed in Firefox 155. The Mozilla Foundation security advisory MFSA 2026-82 lists this vulnerability among multiple high-impact bugs resolved in that release. The CVSS 3.1 base score is 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating a network-exploitable vulnerability with no privileges or user interaction required, resulting in high confidentiality, integrity, and availability impacts. The advisory does not provide further technical details or exploitation methods. The vulnerability affects multiple Ubuntu LTS package versions of mozjs52, but the fix is available in Firefox 155.

The vulnerability allows an attacker to bypass site isolation protections in the DOM Navigation component, potentially leading to full compromise of confidentiality, integrity, and availability of the affected Firefox browser. Given the CVSS score of 9.8, the impact is critical if exploited. However, no known exploits in the wild have been reported to date.

A fix for CVE-2026-84140 is available in Firefox version 155. Users and administrators should upgrade affected Firefox installations to version 155 or later to remediate this vulnerability. Since mozjs52 is a component used in various Ubuntu LTS releases, applying the corresponding security updates from Ubuntu that include Firefox 155 or later will mitigate this issue. There is no indication from the vendor advisory that no action is required or that the issue is already mitigated without patching.