CVE-2026-0889 - Denial-of-service in the DOM: Service Workers component

HIGH

Denial-of-service in the DOM: Service Workers component

Published Jan 13, 2026

7.5

HIGH

CVSS 3.1

EPSS 0.60%

Denial-of-service in the DOM: Service Workers component. This vulnerability was fixed in Firefox 147 and Thunderbird 147.

Product	Package	State	Advisory
Red Hat Enterprise Linux 10	firefox	Not affected	n/a
Red Hat Enterprise Linux 10	rhel10/firefox-flatpak	Not affected	n/a
Red Hat Enterprise Linux 6	firefox	Not affected	n/a
Red Hat Enterprise Linux 7	firefox	Not affected	n/a
Red Hat Enterprise Linux 8	firefox	Not affected	n/a
Red Hat Enterprise Linux 9	firefox	Not affected	n/a

Red Hat statement

Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.

Weaknesses (1)

CWE-400

Uncontrolled Resource Consumption

Link	Providers	Tags
https://access.redhat.com/security/cve/CVE-2026-0889		Vendor Advisory
https://bugzilla.mozilla.org/show_bug.cgi?id=1999084		ExploitIssue TrackingVendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2428964		Issue Tracking
https://nvd.nist.gov/vuln/detail/CVE-2026-0889
https://www.cve.org/CVERecord?id=CVE-2026-0889
https://www.mozilla.org/security/advisories/mfsa2026-01/		Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2026-01/#CVE-2026-0889
https://www.mozilla.org/security/advisories/mfsa2026-04/		Vendor Advisory