External risk intelligence

Firefox and Thunderbird Sandbox Escape via DOM Navigation

CVE advisorySeverity: CRITICAL (CVSS 9.6)

CVE-2026-117861

This vulnerability affects web browsers (Firefox) and email clients (Thunderbird). It is a client-side component (DOM navigation) that requires a user to navigate to malicious content. It is not an internet-facing service, network edge device, or server-side application that is reachable by public internet scanning or passive network exposure.

Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in the DOM: Navigation component of Firefox and Thunderbird. This issue allows for a sandbox escape, which could potentially enable unauthorized access or manipulation of systems. The main concern is confirming the relevance and exposure of this vulnerability to our specific environment.

Sandbox escape in browser navigation.
Could allow attackers to bypass security boundaries.
Confirm relevance and exposure to our systems.

Attack Path

How an attacker could exploit the issue

An attacker could trick a user into visiting a malicious website or opening a specially crafted email. This would allow them to escape the browser's security sandbox, potentially leading to the compromise of the user's system.

No special access needed.
Triggered by user visiting malicious site.
Allows sandbox escape and system compromise.

Live Threat

Current exploitation, exposure, and threat context

A sandbox escape in the DOM: Navigation component could allow an attacker to break out of the browser's or email client's restricted environment when a user navigates to malicious content. This could potentially affect the integrity and confidentiality of the user's system.

System data integrity.
User navigates to malicious content.
Compromise of system data.

Operational Fix

Recommended remediation, mitigation, and detection steps

The real-world ownership for this critical vulnerability likely falls to teams managing end-user computing, such as desktop support or endpoint security, due to its impact on client-side applications like Firefox and Thunderbird. The first practical step is to identify all endpoints running the affected software, assess their exposure to malicious content, and determine the primary owner for each segment before planning a risk-based remediation.

Desktop/endpoint teams should own the issue.
Verify affected software and user exposure.
Plan deployment of vendor fixes.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the DOM: Navigation component in Firefox and Thunderbird?

This component manages how your browser or email client processes links and web page transitions. It handles the movement between different documents or web pages. When it functions correctly, it keeps website processes contained within a secure sandbox so they cannot access your computer's files or system settings.

What does sandbox escape mean for CVE-2026-117861?

This CVE involves a 'Protection Mechanism Failure' (CWE-693). Usually, the software sandbox acts as a virtual wall separating web content from your computer's operating system. A sandbox escape means that wall has been breached, potentially allowing malicious content to bypass these built-in security constraints and interact directly with the underlying system.

How is this vulnerability triggered?

The issue requires a user to interact with specific malicious content, such as visiting a compromised website or opening a specially crafted email. It is not triggered by passive network activity or simply having the application open. If a user does not navigate to malicious content, the flaw remains dormant and cannot be leveraged.

Do I need to worry if this is on my internal systems?

According to Halo Surface Signal, this is not an internet-facing server service that can be remotely probed or scanned by attackers. Because it is a client-side vulnerability requiring user interaction, your primary focus should be on endpoints where employees browse the web or read email, rather than on internal network infrastructure.

When should I update my software to fix this?

You should prioritize updating Firefox and Thunderbird to the versions specified in the vendor advisory as soon as possible. Since this impacts end-user applications, desktop and endpoint security teams should identify systems running older versions and manage the deployment of these updates through standard internal patch cycles.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.