External risk intelligence

Firefox DOM Navigation Sandbox Escape Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.6)

CVE-2026-84119

This vulnerability exists within a web browser's DOM navigation component. While browsers interact with the internet, they are client-side software applications. They do not constitute an internet-facing service, gateway, or externally reachable management surface, making public exposure of this specific component in a server-side context very unlikely.

Use After Free

Mozilla Firefox

before 115.40.0116.0 to before 140.15.0141.0.0 to before 153.2.0154.0.0 to before 155.0.0before 140.15.0141.0 to before 153.2.0154.0 to before 155.0

Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This vulnerability in the browser's navigation component allows for a sandbox escape, potentially impacting user data and system integrity. While the technology is widely used, the primary concern is confirming its relevance and exposure within our specific environment.

Browser navigation flaw allows sandbox escape.
Critical vulnerability could impact user data.
Confirm relevance and exposure to our systems.

Attack Path

How an attacker could exploit the issue

An attacker could trick a user into visiting a malicious website, leading to a sandbox escape within the browser's DOM navigation component. This could allow them to gain elevated privileges, impacting the confidentiality, integrity, and availability of the user's system.

Requires user interaction with malicious site.
Exploits DOM navigation component use-after-free.
Allows sandbox escape and system compromise.

Live Threat

Current exploitation, exposure, and threat context

A use-after-free vulnerability in Firefox's DOM Navigation component could allow an attacker to escape the browser's sandbox. This could occur when a user navigates to a specially crafted web page. The vulnerability could impact the confidentiality, integrity, and availability of data.

Browser sandbox integrity.
Malicious web page navigation.
Sensitive data exposure or system compromise.

Operational Fix

Recommended remediation, mitigation, and detection steps

This sandbox escape vulnerability in the DOM Navigation component of Firefox impacts end-user devices. The first practical step is for security and infrastructure teams to determine the scope of exposure, focusing on whether the affected browser is business-critical and how it's managed. Subsequently, accountable owners must be identified to plan a phased remediation, prioritizing critical assets.

Ownership: Browser/endpoint management teams.
Verify first: Identify all affected endpoints.
Action: Plan phased, risk-based updates.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Firefox's DOM Navigation component?

Firefox is a widely used web browser. The DOM (Document Object Model) Navigation component is a core part of its architecture that helps process and render web page structures. It manages how a user moves between different parts of a page or various websites, ensuring the browser correctly interprets the instructions provided by web servers to display content to the user.

What does CVE-2026-84119 mean by a sandbox escape?

This vulnerability is classified as a use-after-free weakness. In browser security, a sandbox is a safety wall that keeps web content from accessing your computer's operating system. A use-after-free error means the browser tries to use memory it has already cleared. An attacker can exploit this mistake to break through that safety wall, essentially 'escaping' the sandbox to perform unauthorized actions on the underlying system.

How is this sandbox escape triggered?

The vulnerability requires user interaction to occur. It is specifically triggered when a user navigates to a specially crafted, malicious website designed to exploit the memory error. Simply having the browser installed or running it in the background does not trigger the flaw; the malicious site must be actively visited and rendered by the browser's navigation engine.

Do I need to worry about this from the internet?

According to Halo Surface Signal, this is very unlikely to be a direct internet-facing server risk. Because Firefox is client-side software rather than a public-facing service or gateway, the primary concern is a user-driven incident on an endpoint device. While not an externally reachable management surface, the risk remains relevant for any system where users access the open web.

When should I update Firefox to address CVE-2026-84119?

The first step is to identify where Firefox is deployed across your systems. Since this vulnerability impacts the integrity of user devices, teams should verify if the software is business-critical and which endpoints are running affected versions. Once scope is understood, you should plan a phased update strategy to apply the necessary security patches and restore the browser's sandbox protections.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.