CVE-2026-84136 - Other issue in the DOM: Navigation component

CRITICAL

Other issue in the DOM: Navigation component

Published Sep 1, 2026

9.8

CRITICAL

CVSS 3.1

EPSS 0.38%

Other issue in the DOM: Navigation component. This vulnerability was fixed in Firefox 155, Firefox ESR 153.2, Thunderbird 155, and Thunderbird 153.2.

Product	Package	State	Advisory
Red Hat Enterprise Linux 10	firefox	Not affected	n/a
Red Hat Enterprise Linux 10	rhel10/firefox-flatpak	Not affected	n/a
Red Hat Enterprise Linux 10	rhel10/thunderbird-flatpak	Not affected	n/a
Red Hat Enterprise Linux 10	thunderbird	Not affected	n/a
Red Hat Enterprise Linux 6	firefox	Not affected	n/a
Red Hat Enterprise Linux 6	thunderbird	Not affected	n/a
Red Hat Enterprise Linux 7	firefox	Not affected	n/a
Red Hat Enterprise Linux 7	thunderbird	Not affected	n/a
Red Hat Enterprise Linux 8	firefox	Not affected	n/a
Red Hat Enterprise Linux 8	thunderbird	Not affected	n/a
Red Hat Enterprise Linux 9	firefox	Not affected	n/a
Red Hat Enterprise Linux 9	thunderbird	Not affected	n/a

Red Hat statement

Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.

Weaknesses (3)

CWE-200

Exposure of Sensitive Information

CWE-368

CWE-79

Cross-site Scripting (XSS)

Link	Providers	Tags
https://access.redhat.com/security/cve/CVE-2026-84136		Vendor Advisory
https://bugzilla.mozilla.org/show_bug.cgi?id=2048699		Issue TrackingPermissions Required
https://bugzilla.redhat.com/show_bug.cgi?id=2526771		Issue Tracking
https://nvd.nist.gov/vuln/detail/CVE-2026-84136
https://www.cve.org/CVERecord?id=CVE-2026-84136
https://www.mozilla.org/security/advisories/mfsa2026-82/		Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2026-82/#CVE-2026-84136
https://www.mozilla.org/security/advisories/mfsa2026-85/		Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2026-85/#CVE-2026-84136
https://www.mozilla.org/security/advisories/mfsa2026-86/		Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2026-86/#CVE-2026-84136
https://www.mozilla.org/security/advisories/mfsa2026-88/		Vendor Advisory