CVE-2026-84137
UnknownSummary
Spoofing vulnerability in the DOM: Core & HTML component of Firefox. It was fixed in Firefox 155 and Firefox ESR 153.2.
Risk Assessment
An attacker could exploit this vulnerability to spoof trusted content, potentially leading to fraud or data theft.
Recommendation
Update Firefox to version 155 or later, and for ESR to 153.2 or later.
Other vulnerabilities in Firefox
See all- CVE-2026-84145High
Internally found bugs present in Firefox 154, Firefox ESR 153.1, Firefox ESR 140.14 and Firefox ESR 115.39. Some showed evidence of memory corruption or another security-relevant defect, potentially exploitable. Fixed in Firefox 155, Firefox ESR 115.40, Firefox ESR 140.15, and Firefox ESR 153.2.
- CVE-2026-84144Unknown
Internally found bugs present in Firefox 154 and Firefox ESR 153.1. Some of these bugs showed evidence of memory corruption or another security-relevant defect and we presume that with enough effort some of these could have been exploited. This vulnerability was fixed in Firefox 155 and Firefox ESR 153.2.
- CVE-2026-84143Unknown
Internally found bugs present in Firefox 154, Firefox ESR 153.1 and Firefox ESR 140.14. Some of these bugs showed evidence of memory corruption or another security-relevant defect and we presume that with enough effort some of these could have been exploited. This vulnerability was fixed in Firefox 155, Firefox ESR 140.15, and Firefox ESR 153.2.
- CVE-2026-84142Unknown
Internally found bugs present in Firefox 154. Some of these bugs showed evidence of memory corruption or another security-relevant defect and we presume that with enough effort some of these could have been exploited. This vulnerability was fixed in Firefox 155.
- CVE-2026-84141Unknown
Integer overflow in the Graphics: ImageLib component. This vulnerability was fixed in Firefox 155 and Firefox ESR 153.2.
- CVE-2026-84140Unknown
Site isolation issue in the DOM: Navigation component. This vulnerability was fixed in Firefox 155 and Firefox ESR 153.2.
- CVE-2026-84139Unknown
Clickjacking issue in the DOM: Events component. This vulnerability was fixed in Firefox 155 and Firefox ESR 153.2.
- CVE-2026-84138Unknown
Denial-of-service in the PDF Viewer component. This vulnerability was fixed in Firefox 155.
- CVE-2026-84136Unknown
Other issue in the DOM: Navigation component of Firefox. It was fixed in Firefox 155 and Firefox ESR 153.2.
- CVE-2026-84134Unknown
Other issue in the Profile Backup component of Firefox. It was fixed in Firefox 155 and Firefox ESR 153.2.
Original NVD description (English source)
Spoofing issue in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 155 and Firefox ESR 153.2.