CVE-2026-0889

Denial-of-service in the DOM: Service Workers component

High · published January 13, 2026

CVSS v3.1
7.5
EPSS
0%
Percentile
38.8
In the wild
Unconfirmed
What it is

⚡ A crafty Denial-of-Service bug lurks in the Service Workers component of Firefox and Thunderbird! This sneaky flaw can bring your browser to a grinding halt. 🔥 Think of it like a restaurant that can’t serve any food because one cook keeps burning all the orders — it prevents everyone else from enjoying their meal. That’s what this vulnerability does to your browsing experience! If exploited, this vulnerability could lead to a complete freeze of your browser, leaving users stuck like a deer in headlights. In a world where quick access to information is key, this kind of downtime could be absolutely devastating for productivity!

Put simply

Think of it like a restaurant that can’t serve any food because one cook keeps burning all the orders — it prevents everyone else from enjoying their meal. That’s what this vulnerability does to your browsing experience! This Denial-of-Service vulnerability allows attackers to disrupt the normal operation of the browser by exploiting issues in the Service Workers component, effectively putting it in a state where it can no longer respond to requests.

What to do

If exploited, this vulnerability could lead to a complete freeze of your browser, leaving users stuck like a deer in headlights. In a world where quick access to information is key, this kind of downtime could be absolutely devastating for productivity! To protect yourself, immediately update Firefox and Thunderbird to version 147 or later. Regularly check for updates to ensure you're not left vulnerable to this frustrating flaw! You've got this! Stay vigilant, keep your software updated, and you'll keep those browsing interruptions at bay! 🛡️

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00459 · 38.8th percentile
Published
2026-01-13T13:30Z
EPSS history
Timeline
  • 13 JAN 13:30Z
    Denial-of-service in the DOM: Service Workers component
    cvelistv5