CVE-2026-84133

CRITICAL 9.8CVE-2026-84133 · Published 01/09/2026 · updated 03/09/2026

Package	Affected versions	Patched versions
firefox mozilla	`≥ 154.0.0, < 155.0.0< 153.2.0`	`155.0.0153.2.0`
thunderbird mozilla	`≥ 154.0, < 155.0< 153.2.0`	`155.0153.2.0`

Description

Site isolation issue in the DOM: Push Subscriptions component. This vulnerability was fixed in Firefox 155, Firefox ESR 153.2, Thunderbird 155, and Thunderbird 153.2.

References

bugzilla.mozilla.org/show_bug.cgi · Permissions Required
mozilla.org/security/advisories/mfsa2026-82 · Vendor Advisory
mozilla.org/security/advisories/mfsa2026-85 · Vendor Advisory
mozilla.org/security/advisories/mfsa2026-86 · Vendor Advisory
mozilla.org/security/advisories/mfsa2026-88 · Vendor Advisory

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free