CVE-2026-84123: Vulnerability in Mozilla Firefox

CVE-2026-84123 is a use-after-free vulnerability in the Graphics: WebGPU component of Mozilla Firefox that leads to privilege escalation. This memory corruption flaw allows an attacker to gain elevated privileges by exploiting the improper reuse of freed memory. The vulnerability affects Firefox versions prior to 155 and Firefox ESR versions prior to 153.2. Mozilla has addressed this issue with official fixes released in Firefox 155 and Firefox ESR 153.2. The vulnerability has a CVSS v3.1 base score of 8.8, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, and high impact on confidentiality, integrity, and availability. There are no known active exploits in the wild at this time.

Successful exploitation of this vulnerability could allow an attacker to escalate privileges within the Firefox process, potentially leading to unauthorized actions or access to sensitive information. The high CVSS score reflects significant impact on confidentiality, integrity, and availability of the affected software. However, no active exploitation has been reported so far.

Mozilla has released official fixes for this vulnerability in Firefox 155 and Firefox ESR 153.2. Users and administrators should update affected Firefox and Thunderbird installations to these versions or later to remediate the issue. There are no additional mitigation steps required beyond applying the official updates.