CVE-2026-0889
published 2026-01-13CVE-2026-0889: Denial-of-service in the DOM: Service Workers component. This vulnerability was fixed in Firefox 147 and Thunderbird 147.
PriorityP337high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
EPSS
0.46%
38.9th percentile
Denial-of-service in the DOM: Service Workers component. This vulnerability was fixed in Firefox 147 and Thunderbird 147.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | firefox | < firefox 147.0-1 (sid) | firefox 147.0-1 (sid) |
| mozilla | firefox | < 147.0 | 147.0 |
| mozilla | firefox | — | — |
| mozilla | thunderbird | < 147.0 | 147.0 |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
osv7.5HIGH
vendor_debian7.5HIGH
vendor_redhat7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Mozilla Firefox up to 146 Service Workers denial of service (EUVD-2026-2081 / WID-SEC-2026-0090)
vuldb·2026-06-12·CVSS 7.5
CVE-2026-0889 [HIGH] Mozilla Firefox up to 146 Service Workers denial of service (EUVD-2026-2081 / WID-SEC-2026-0090)
A vulnerability identified as problematic has been detected in Mozilla Firefox up to 146. Impacted is an unknown function of the component Service Workers. Performing a manipulation results in denial of service.
This vulnerability is reported as CVE-2026-0889. The attack is possible to be carried out remotely. No exploit exists.
You should upgrade the affected component.
OSV
CVE-2026-0889: Denial-of-service in the DOM: Service Workers component
osv·2026-01-13·CVSS 7.5
CVE-2026-0889 [HIGH] CVE-2026-0889: Denial-of-service in the DOM: Service Workers component
Denial-of-service in the DOM: Service Workers component. This vulnerability affects Firefox < 147 and Thunderbird < 147.
GHSA
GHSA-4m35-v3c2-29x8: Denial-of-service in the DOM: Service Workers component
ghsa_unreviewed·2026-01-13
CVE-2026-0889 [HIGH] CWE-400 GHSA-4m35-v3c2-29x8: Denial-of-service in the DOM: Service Workers component
Denial-of-service in the DOM: Service Workers component. This vulnerability affects Firefox < 147.
Red Hat
firefox: Denial-of-service in the DOM: Service Workers component
vendor_redhat·2026-01-13·CVSS 7.5
CVE-2026-0889 [HIGH] firefox: Denial-of-service in the DOM: Service Workers component
firefox: Denial-of-service in the DOM: Service Workers component
Denial-of-service in the DOM: Service Workers component. This vulnerability affects Firefox < 147 and Thunderbird < 147.
A flaw was found in Firefox. The Mozilla Foundation's Security Advisory describes the following issue:
Denial-of-service in the DOM: Service Workers component
Statement: Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.
Package: firefox (Red Hat Enterprise Linux 10) - Not affected
Package: rhel10/firefox-flatpak (Red Hat Enterprise Linux 10) - Not affected
Package: firefox (Red Hat Enterprise Linux 6) - Not affected
Package: firefox (Red Hat Enterprise Linux 7) - Not affected
Package: firefox (Red Hat Enterprise Linux 8) - Not affecte
Debian
CVE-2026-0889: firefox - Denial-of-service in the DOM: Service Workers component. This vulnerability affe...
vendor_debian·2026·CVSS 7.5
CVE-2026-0889 [HIGH] CVE-2026-0889: firefox - Denial-of-service in the DOM: Service Workers component. This vulnerability affe...
Denial-of-service in the DOM: Service Workers component. This vulnerability affects Firefox < 147 and Thunderbird < 147.
Scope: local
sid: resolved (fixed in 147.0-1)
Mozilla
Mozilla Foundation Security Advisory 2026-04: CVE-2026-0889
vendor_mozilla·CVSS 7.5
CVE-2026-0889 [HIGH] Mozilla Foundation Security Advisory 2026-04: CVE-2026-0889
Mozilla Foundation Security Advisory 2026-04
CVE: CVE-2026-0889
Product: Thunderbird
Impact: moderate
Fixed in: Thunderbird 147
Mozilla
Mozilla Foundation Security Advisory 2026-01: CVE-2026-0889
vendor_mozilla·CVSS 7.5
CVE-2026-0889 [HIGH] Mozilla Foundation Security Advisory 2026-01: CVE-2026-0889
Mozilla Foundation Security Advisory 2026-01
CVE: CVE-2026-0889
Product: Firefox
Impact: moderate
Fixed in: Firefox 147
No detection rules found.
No public exploits indexed.
Bugzilla
No limit on Service Worker Registration leads to Resource Exhaustion Attack
bugzilla·2025-11-12
CVE-2026-0889 No limit on Service Worker Registration leads to Resource Exhaustion Attack
No limit on Service Worker Registration leads to Resource Exhaustion Attack
Created attachment 9526039
firefox_memory_exhaustion_demo_windows.mp4
# No limit on Service Worker Registration leads to Resource Exhaustion Attack
##### Version Info
I have tested this issue on Firefox nightly on Windows 11 and on Ubuntu 24.04.3
Firefox nightly version: 147.0a1 (2025-11-11)(64 bit)
##### Description of Impact
A malicious server can exhaust the host machine resources (memory and CPU) of any firefox client that visits it, without user interaction. This is easy to execute, occurs on multiple operating systems, and is easy to reproduce.
##### What should happen:
Firefox should have built in protections to prevent from overloading operating system resources. For example when testing the same paylo
Wiz
CVE-2026-0889 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 7.5
CVE-2026-0889 [HIGH] CVE-2026-0889 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2026-0889 :
NixOS vulnerability analysis and mitigation
Denial-of-service in the DOM: Service Workers component. This vulnerability affects Firefox < 147 and Thunderbird < 147.
Source : NVD
## 7.5
Score
Published January 13, 2026
Severity HIGH
CNA Score 7.5
Affected Technologies
NixOS
Mozilla Firefox
Has Public Exploit Yes
Has CISA KEV Exploit No
CISA KEV Release Date N/A
CISA KEV Due Date N/A
Exploitation Probability Percentile (EPSS) 6.1
Exploitation Probability (EPSS) N/A
Affected packages and libraries
firefox
thunderbird
Sources
Homebrew Severity HIGH Has Fix Added at: Jan 23, 2026
Nix Severity HIGH Has Fix Added at: Jan 23, 2026
Ubuntu 22.04 Severity MEDIUM No Fix Added at: Jan 15, 2026
Linux Severity HIGH Has Fix Added at: Jan 14, 2026
Windows Seve
2026-01-13
Published