CVE-2026-84140 is a site isolation issue in the DOM Navigation component of Firefox and Thunderbird, scored 9.8 by NVD while Mozilla rates its impact as low. Mozilla fixed it in Firefox 155, Firefox ESR 153.2, Thunderbird 155 and Thunderbird 153.2. Update to one of those.
What's affected
The record lists the fix as Firefox 155, Firefox ESR 153.2, Thunderbird 155 and Thunderbird 153.2. Mozilla's advisories MFSA 2026-82 for Firefox and MFSA 2026-85 for Firefox ESR, both announced on 1 September 2026, list it as CVE-2026-84140 with an impact of low and a link to Bug 2063780.
Older versions of those products are affected. Mozilla's text does not describe the flaw beyond the component name.
How to check if you're exposed
Check the version in the browser or mail client. In Firefox, open the menu, then Help, then About Firefox. In Thunderbird, use Help, then About Thunderbird. For fleet checks, read the version from your software inventory.
firefox --version
thunderbird --version
Compare to Firefox 155 or ESR 153.2, and Thunderbird 155 or 153.2.
What to do now
- Update Firefox to 155 or later, or Firefox ESR to 153.2 or later.
- Update Thunderbird to 155 or 153.2 or later.
- If you manage an ESR fleet, move to the ESR 153.2 release through your normal channel.
- Review the other items in Mozilla's advisories while you are updating.
- Make sure automatic updates are on, and check that managed policies do not block them.
Why it matters
The record lists CWE-346, origin validation error. Site isolation keeps content from different sites in separate processes, so a flaw that weakens it can let one site influence another.
Mozilla rates this one low, and NVD gives it 9.8 based on a general vector. Browsers are patched frequently and the safest practice is to follow the release. The record is not listed in CISA's KEV catalog, and Mozilla's advisories do not report exploitation of this issue.
Browser advisories can be confusing because they carry many records at once. MFSA 2026-82 covers Firefox 155, and MFSA 2026-85 covers Firefox ESR 153.2. The same CVE appears in both with different fixed versions. That is normal, and it means you only need to find the line that matches the product channel you run.
For managed fleets the useful work is checking that update policies work. Many organizations pin an ESR channel and then forget the pin. Check that your devices are on a supported ESR and that they can reach update servers, or that your software distribution pipeline has the new package.
The disagreement between a 9.8 score and a low vendor rating is worth recording in your ticket. It tells the next reader that you saw both and chose to update on the normal schedule, with the update being low cost.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Do ESR users need a different fix?
Yes. ESR users should move to Firefox ESR 153.2 or later, which is the version named in the record.
Sources
- Mozilla Foundation Security Advisory 2026-82 (Firefox 155)
- Mozilla Foundation Security Advisory 2026-85 (Firefox ESR 153.2)
Last reviewed: 19 October 2026.
