CVE-2026-84139: Firefox DOM Events Clickjacking Vulnerability

CVE-2026-84139 Overview

CVE-2026-84139 is a clickjacking vulnerability in the DOM: Events component of Mozilla Firefox and Thunderbird. The flaw allows attackers to trick users into performing unintended actions by manipulating how DOM events are processed and dispatched. Mozilla addressed the issue in Firefox 155, Firefox ESR 153.2, Thunderbird 155, and Thunderbird 153.2. The vulnerability is documented across multiple Mozilla Foundation Security Advisories, including MFSA-2026-82, MFSA-2026-85, MFSA-2026-86, and MFSA-2026-88.

Critical Impact
Attackers can exploit the DOM: Events component to overlay or hijack user interactions, potentially causing users to trigger unintended actions on legitimate web content.

Affected Products

Mozilla Firefox versions prior to 155
Mozilla Firefox ESR versions prior to 153.2
Mozilla Thunderbird versions prior to 155 and prior to 153.2

Discovery Timeline

2026-09-01 - CVE-2026-84139 published to NVD
2026-09-01 - Last updated in NVD database

Technical Details for CVE-2026-84139

Vulnerability Analysis

The vulnerability resides in the DOM: Events component, which handles event dispatching and propagation within the browser rendering engine. Clickjacking (also known as UI redress) enables attackers to layer transparent or opaque elements over legitimate interface controls. When a user clicks what appears to be benign content, the click is redirected to an attacker-controlled target.

In this case, the flaw involves how DOM events are processed, allowing adversary-crafted pages to manipulate event handling in ways that bypass expected user interaction protections. The specific technical mechanism is tracked in Mozilla Bug Report #2060153.

Root Cause

The root cause is improper enforcement of user interface protections within the DOM: Events component. Event handling did not adequately prevent attacker-controlled overlays or event redirection, enabling UI redress attacks. This falls under user interface confusion and insufficient framing or interaction safeguards.

Attack Vector

Exploitation requires a victim to visit a malicious web page or view attacker-controlled HTML content. The attacker crafts a page that overlays or manipulates event delivery so user clicks or keystrokes are routed to unintended targets. In Thunderbird, rendering of malicious remote content within messages presents an additional exposure surface. No authentication is required, but user interaction is mandatory.

The vulnerability is described in prose only. Refer to the Mozilla Security Advisory MFSA-2026-82 for additional technical context.

Detection Methods for CVE-2026-84139

Indicators of Compromise

Web pages containing transparent iframes, CSS overlays, or z-index manipulation targeting legitimate site controls
Unexpected DOM event listeners attached to invisible elements covering interactive UI regions
HTML email content in Thunderbird that renders overlays or intercepts click events on external links

Detection Strategies

Inspect HTTP traffic for pages hosting iframes referencing sensitive third-party domains with opacity: 0 or pointer-events manipulation
Deploy browser telemetry to flag anomalous DOM event dispatch patterns tied to overlay elements
Correlate outbound browser activity with domains recently registered or lacking reputation data

Monitoring Recommendations

Monitor endpoints for Firefox and Thunderbird versions below the patched releases and enforce update compliance
Log and alert on user reports of unexpected authentication prompts or unintended actions following link clicks
Track web proxy logs for pages combining iframes with click-tracking scripts targeting known SaaS applications

How to Mitigate CVE-2026-84139

Immediate Actions Required

Upgrade Firefox to version 155 or later and Firefox ESR to 153.2 or later across all managed endpoints
Upgrade Thunderbird to version 155 or later, or ESR 153.2 or later, on all workstations
Disable remote content loading in Thunderbird for untrusted senders to reduce message-based exposure

Patch Information

Mozilla released fixes in Firefox 155, Firefox ESR 153.2, Thunderbird 155, and Thunderbird 153.2. Patch details are available in Mozilla Security Advisory MFSA-2026-85, Mozilla Security Advisory MFSA-2026-86, and Mozilla Security Advisory MFSA-2026-88.

Workarounds

Enforce Content Security Policy (CSP) directives such as frame-ancestors 'none' on internal web applications to prevent framing
Deploy browser configuration policies that block third-party iframes on sensitive corporate domains
Train users to recognize suspicious overlays and unexpected click behavior on unfamiliar sites

bash

# Configuration example: enforce Firefox update policy via policies.json
{
  "policies": {
    "DisableAppUpdate": false,
    "AppUpdateURL": "https://aus5.mozilla.org/update/",
    "OverrideFirstRunPage": "",
    "BlockAboutConfig": true
  }
}