CVE-2026-84133 Overview
CVE-2026-84133 is a site isolation issue in the DOM Push Subscriptions component of Mozilla Firefox and Thunderbird. Site isolation defects in this component can allow cross-origin data to interact in ways the same-origin policy is intended to prevent. Mozilla fixed the flaw in Firefox 155, Firefox ESR 153.2, Thunderbird 155, and Thunderbird 153.2. The issue is tracked in Mozilla Bug 2032388 and covered by advisories MFSA 2026-82, MFSA 2026-85, MFSA 2026-86, and MFSA 2026-88.
Critical Impact
Weakened site isolation in the Push Subscriptions component can undermine boundaries between web origins in Firefox and Thunderbird until patched builds are deployed.
Affected Products
- Mozilla Firefox versions prior to 155
- Mozilla Firefox ESR versions prior to 153.2
- Mozilla Thunderbird versions prior to 155 and prior to 153.2
Discovery Timeline
- 2026-09-01 - CVE-2026-84133 published to NVD
- 2026-09-01 - Last updated in NVD database
Technical Details for CVE-2026-84133
Vulnerability Analysis
The vulnerability resides in the DOM Push Subscriptions component, which manages Web Push registrations tied to service workers. Site isolation is the browser architecture that keeps content from different origins in separate processes and data stores. A defect in this boundary within Push Subscriptions can allow subscription state, endpoints, or associated data to be handled outside the intended origin scope. Mozilla classifies the defect as a site isolation issue and addressed it across the Firefox 155, ESR 153.2, and matching Thunderbird release trains.
The advisories cover Firefox, Firefox ESR, and Thunderbird because Thunderbird embeds the Gecko rendering engine used by Firefox. Any application relying on the vulnerable Gecko builds inherits the flaw.
Root Cause
Mozilla's advisory identifies the root cause as improper site isolation enforcement within the Push Subscriptions code path. Push subscription data, which should be partitioned strictly per origin, could be reached or influenced from contexts outside that origin. Full technical details are tracked in Mozilla Bug 2032388.
Attack Vector
Exploitation requires the victim to load attacker-controlled or attacker-influenced web content in a vulnerable Firefox or Thunderbird build. No exploit code is publicly available, and the flaw is not listed in the CISA Known Exploited Vulnerabilities catalog. See the Mozilla Security Advisory MFSA 2026-82 for advisory-level guidance.
No verified public proof-of-concept code exists for this issue. Refer to the linked Mozilla advisories and bug report for technical specifics.
Detection Methods for CVE-2026-84133
Indicators of Compromise
- No public indicators of compromise have been published for CVE-2026-84133.
- Presence of Firefox or Thunderbird builds older than the fixed versions in an environment is the primary risk signal.
Detection Strategies
- Inventory installed Firefox, Firefox ESR, and Thunderbird versions across managed endpoints and flag builds older than 155 or ESR 153.2.
- Correlate browser version telemetry with process execution logs to identify hosts running vulnerable Gecko-based applications.
- Review Web Push service worker registrations and endpoints on managed browsers where governance policies apply.
Monitoring Recommendations
- Monitor endpoint software inventory for Mozilla product updates and alert on stalled version rollouts.
- Track outbound connections to Web Push endpoints from user browsers to detect unexpected subscription activity.
- Watch vendor channels for updates to MFSA 2026-82, MFSA 2026-85, MFSA 2026-86, and MFSA 2026-88.
How to Mitigate CVE-2026-84133
Immediate Actions Required
- Upgrade Firefox to version 155 or later on all managed endpoints.
- Upgrade Firefox ESR to version 153.2 or later where the ESR channel is deployed.
- Upgrade Thunderbird to version 155 or 153.2 or later.
- Validate patch deployment through software inventory tooling before closing the remediation ticket.
Patch Information
Mozilla shipped fixes in Firefox 155, Firefox ESR 153.2, Thunderbird 155, and Thunderbird 153.2. Detailed advisory content is available in MFSA 2026-82, MFSA 2026-85, MFSA 2026-86, and MFSA 2026-88.
Workarounds
- No vendor-supplied workaround has been published. Patching is the supported remediation path.
- Where patching is delayed, restrict use of vulnerable Firefox or Thunderbird builds for browsing untrusted content.
- Consider disabling Web Push notifications through enterprise policy where the feature is not business-critical.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
