CVE-2026-84140
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk8th percentile - higher than 8% of all known CVEs
Summary
Site isolation issue in the DOM: Navigation component. This vulnerability was fixed in Firefox 155, Firefox ESR 153.2, Thunderbird 155, and Thunderbird 153.2.
Risk Assessment
May allow a website to access data from another site, breaking security isolation.
Recommendation
Update Firefox or Thunderbird to the latest available version containing the fix.
Other vulnerabilities in Firefox
See all- CVE-2026-109755Critical
A vulnerability in the DOM: Content Processes component allows sandbox escape. It was fixed in Firefox 158 and Thunderbird 158.
- CVE-2026-109708Critical
Sandbox escape due to incorrect boundary conditions in the Networking component. The vulnerability was fixed in Firefox 158, Firefox ESR 153.5, and Thunderbird 158 and 153.5.
- CVE-2026-109707Critical
Sandbox escape due to use-after-free in the Networking component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.
- CVE-2026-109705Critical
Sandbox escape, site isolation issue due to incorrect boundary conditions, use-after-free in the Networking component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.
- CVE-2026-106016Critical
Mitigation bypass in the File Handling component. This vulnerability was fixed in Firefox 157.0.1 and Thunderbird 158.
- CVE-2026-100829Critical
Mitigation bypass in the DOM: Security component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157.
- CVE-2026-100828Critical
Mitigation bypass in the Bookmarks & History component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157.
- CVE-2026-100819Critical
Sandbox escape due to incorrect boundary conditions in the XPCOM component. Fixed in multiple Firefox and Thunderbird versions.
- CVE-2026-100818Critical
Sandbox escape due to use-after-free in the Widget: Gtk component. Fixed in multiple Firefox and Thunderbird versions.
- CVE-2026-100811Critical
Sandbox escape due to use-after-free in the DOM: Core & HTML component. Fixed in multiple Firefox and Thunderbird versions.
Original NVD description (English source)
Site isolation issue in the DOM: Navigation component. This vulnerability was fixed in Firefox 155, Firefox ESR 153.2, Thunderbird 155, and Thunderbird 153.2.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS