CVE-2026-84140: Firefox DOM Navigation Site Isolation Flaw

CVE-2026-84140 Overview

CVE-2026-84140 is a site isolation issue affecting the DOM: Navigation component in Mozilla Firefox and Thunderbird. Site isolation weaknesses can allow content from one origin to influence or observe navigation state associated with another origin, weakening the browser's cross-origin security boundaries. Mozilla addressed the flaw across multiple product lines in Firefox 155, Firefox ESR 153.2, Thunderbird 155, and Thunderbird 153.2. The issue is documented in Mozilla Foundation Security Advisories MFSA-2026-82, MFSA-2026-85, MFSA-2026-86, and MFSA-2026-88, with underlying engineering detail tracked in Mozilla Bug 2063780.

Critical Impact
A site isolation weakness in the DOM: Navigation component may enable cross-origin interference that undermines the browser's same-origin protections until users upgrade to a fixed release.

Affected Products

Mozilla Firefox versions prior to 155
Mozilla Firefox ESR versions prior to 153.2
Mozilla Thunderbird versions prior to 155 and prior to 153.2

Discovery Timeline

2026-09-01 - CVE-2026-84140 published to the National Vulnerability Database
2026-09-01 - Last updated in NVD database

Technical Details for CVE-2026-84140

Vulnerability Analysis

The vulnerability resides in the DOM Navigation component, which coordinates document loads, session history entries, and browsing context transitions inside Firefox and Thunderbird. Site isolation is the browser architecture that keeps documents from different origins in separate processes or otherwise prevents them from sharing state. When a navigation path fails to preserve that boundary, one origin can influence navigation events or state that should remain scoped to another origin. Mozilla classifies the finding as a site isolation issue, indicating the browser did not consistently enforce the origin partitioning expected during navigation handling.

Root Cause

Mozilla's advisories describe the defect as a site isolation issue within the DOM: Navigation component. The technical root cause is not published in detail in the advisories referenced by NVD, and no CWE identifier has been assigned. Readers seeking implementation-level context should consult Mozilla Bug Report #2063780 once access restrictions are lifted.

Attack Vector

Exploitation requires a victim to load attacker-controlled web content in a vulnerable Firefox or Thunderbird build. A malicious page could then leverage the navigation flaw to influence or observe activity tied to another origin loaded in the same browser session. No authentication is required, and the attack occurs entirely through standard web rendering paths. The Exploit Prediction Scoring System places this CVE in a low probability band, and no public exploit code or in-the-wild abuse has been reported. See the Mozilla Security Advisory MFSA-2026-82 for the vendor's disclosure text.

No verified proof-of-concept code is available for this vulnerability. The referenced Mozilla advisories describe the defect at a high level without publishing exploitation details.

Detection Methods for CVE-2026-84140

Indicators of Compromise

No public indicators of compromise have been published for CVE-2026-84140.
Absence of the Firefox or Thunderbird patched build on managed endpoints is the most reliable signal of exposure.

Detection Strategies

Inventory installed browser and mail client versions across the fleet and flag any Firefox build below 155, Firefox ESR below 153.2, or Thunderbird below 155 or 153.2.
Correlate browser telemetry with visits to untrusted sites while unpatched versions are in use, since exploitation requires loading attacker content.
Monitor process creation and child-process behavior of firefox.exe and thunderbird.exe for anomalies that could indicate exploitation follow-on activity.

Monitoring Recommendations

Ingest endpoint software inventory into a centralized data lake to continuously identify hosts running vulnerable Mozilla builds.
Alert on browser crashes or renderer-process anomalies that coincide with navigation events, which may indicate abuse of the DOM Navigation component.
Track outbound web traffic from workstations still running unpatched Firefox or Thunderbird until remediation completes.

How to Mitigate CVE-2026-84140

Immediate Actions Required

Upgrade Firefox to version 155 or later on all managed endpoints.
Upgrade Firefox ESR deployments to 153.2 or later to receive the site isolation fix on the extended support channel.
Update Thunderbird installations to version 155 or 153.2, matching the release train in use.
Prioritize systems used for general web browsing or handling untrusted email content, as these have the highest exposure to malicious navigation payloads.

Patch Information

Mozilla fixed CVE-2026-84140 in Firefox 155, Firefox ESR 153.2, Thunderbird 155, and Thunderbird 153.2. The corresponding advisories are MFSA-2026-82, MFSA-2026-85, MFSA-2026-86, and MFSA-2026-88. Administrators should deploy the vendor-provided installers or enable automatic updates through enterprise policy.

Workarounds

No vendor-approved workaround has been published; upgrading to a fixed release is the supported remediation.
Where patching is delayed, restrict browsing to trusted sites and disable JavaScript on untrusted origins using enterprise policy.
Consider enforcing use of a fully patched alternative browser on high-risk workstations until Firefox and Thunderbird are updated.

bash

# Configuration example: enforce Firefox auto-update via enterprise policy (policies.json)
{
  "policies": {
    "DisableAppUpdate": false,
    "AppAutoUpdate": true,
    "ManualAppUpdateOnly": false
  }
}