CVE-2026-84121: Vulnerability in Mozilla Firefox

CVE-2026-84121 is a use-after-free vulnerability in the DOM security component of Mozilla Firefox that enables sandbox escape. This memory corruption flaw was discovered internally and reported by Yaqoub Aldurayhim. It affects Firefox and Thunderbird before versions Firefox 155, Firefox ESR 115.40, 140.15, 153.2, and Thunderbird 155, 140.15, 153.2. The vulnerability allows an attacker to escape the browser sandbox, potentially leading to full system compromise. Mozilla addressed this issue in their Firefox 155 release and corresponding ESR and Thunderbird versions. The CVSS v3.1 base score is 9.6 (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H), reflecting network attack vector, low complexity, no privileges required, user interaction required, scope changed, and high impact on confidentiality, integrity, and availability. Vendor advisories mfsa2026-82 and mfsa2026-83 provide official confirmation and remediation details.

Successful exploitation of this use-after-free vulnerability allows an attacker to escape the Firefox sandbox, potentially leading to full compromise of the affected system's confidentiality, integrity, and availability. The vulnerability is critical with a CVSS score of 9.6. No known active exploits have been reported in the wild at this time.

Mozilla has fixed this vulnerability in Firefox 155, Firefox ESR 115.40, 140.15, 153.2, and Thunderbird 155, 140.15, and 153.2. Users and administrators should update to these fixed versions or later to remediate the issue. Patch status is confirmed by Mozilla security advisories mfsa2026-82 and mfsa2026-83. No additional mitigation steps are required beyond applying the official updates.