CVE-2026-0877

Mitigation bypass in the DOM: Security component

High · published January 13, 2026

CVSS v3.1
8.1
EPSS
0%
Percentile
39.9
In the wild
Unconfirmed
What it is

⚡ A sneaky bypass in the DOM security component could let attackers slip past defenses like a cat burglar through a half-open window! Think of it like a security guard who gets distracted just long enough for someone to sneak in without the usual checks. If the guard isn't alert, who knows what could happen? This vulnerability could allow malicious scripts to execute in a trusted context, potentially leading to data theft or unauthorized actions within the application. It’s like leaving your house keys under the mat — inviting trouble right to your doorstep!

Put simply

Think of it like a security guard who gets distracted just long enough for someone to sneak in without the usual checks. If the guard isn't alert, who knows what could happen? The mitigation bypass in the DOM allows attackers to circumvent security checks by exploiting the vulnerabilities in Firefox and Thunderbird, compromising the integrity of the application.

What to do

This vulnerability could allow malicious scripts to execute in a trusted context, potentially leading to data theft or unauthorized actions within the application. It’s like leaving your house keys under the mat — inviting trouble right to your doorstep! Update your Firefox to version 147 or Firefox ESR to version 115.32 or 140.7, and Thunderbird to version 147 or 140.7 immediately. Keep your software up-to-date to ensure robust security! You've got this! Follow these steps to lock things down tight and keep your digital fortress secure! 🛡️

The record
Technical detail
CVSS v3.1
8.1 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00473 · 39.9th percentile
Published
2026-01-13T13:30Z
EPSS history
Timeline
  • 13 JAN 13:30Z
    Mitigation bypass in the DOM: Security component
    cvelistv5