CVE-2026-0889
📋 TL;DR
A denial-of-service vulnerability in Firefox and Thunderbird's DOM Service Workers component allows attackers to crash the browser or email client. This affects users running Firefox versions below 147 or Thunderbird versions below 147, potentially disrupting work and causing data loss.
💻 Affected Systems
- Mozilla Firefox
- Mozilla Thunderbird
📦 What is this software?
Firefox by Mozilla
Thunderbird by Mozilla
⚠️ Risk & Real-World Impact
Worst Case
Complete browser/email client crash requiring restart, potential loss of unsaved work or active sessions, and disruption of critical workflows.
Likely Case
Browser or email client becomes unresponsive and crashes, requiring manual restart and causing temporary disruption.
If Mitigated
Minimal impact with proper patching; crashes are prevented and normal functionality is maintained.
🎯 Exploit Status
Exploitation likely requires visiting a malicious website or opening a crafted email. No authentication needed.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Firefox 147, Thunderbird 147
Vendor Advisory: https://www.mozilla.org/security/advisories/mfsa2026-01/
Restart Required: Yes
Instructions:
1. Open Firefox/Thunderbird. 2. Click menu → Help → About Firefox/Thunderbird. 3. Allow automatic update to version 147 or higher. 4. Restart the application when prompted.
🔧 Temporary Workarounds
Disable Service Workers
allTemporarily disable Service Workers to prevent exploitation, but may break some web functionality.
In Firefox/Thunderbird address bar, type 'about:config', search for 'dom.serviceWorkers.enabled', set to false
🧯 If You Can't Patch
- Restrict access to untrusted websites and email sources.
- Use application sandboxing or isolation techniques to limit impact of crashes.
🔍 How to Verify
Check if Vulnerable:
Check Firefox/Thunderbird version via menu → Help → About. If version is below 147, you are vulnerable.Check Version:
firefox --version (Linux) or check About dialog (Windows/macOS)Verify Fix Applied:
Confirm version is 147 or higher after update and restart. Test Service Worker functionality on trusted sites.📡 Detection & Monitoring
Log Indicators:
- Application crash logs, unexpected termination events, high memory usage spikes before crash
Network Indicators:
- Requests to suspicious domains triggering Service Worker scripts, unusual Service Worker registration patterns
SIEM Query:
source="firefox.log" OR source="thunderbird.log" AND (event="crash" OR event="terminated") AND version<147