CVE-2026-84128: Vulnerability in Mozilla Firefox

CVE-2026-84128 is a privilege escalation vulnerability affecting the WebDriver BiDi component in Mozilla Firefox. The flaw allows an attacker to gain elevated privileges, which could lead to unauthorized actions within the browser context. This vulnerability was addressed and fixed in Firefox 155 as part of a security update that also resolved multiple other high-impact bugs. The CVSS v3.1 base score is 8.8, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, and high impact on confidentiality, integrity, and availability. The Mozilla advisory explicitly states the vulnerability was fixed in Firefox 155.

Successful exploitation of this vulnerability could allow an attacker to escalate privileges within the Firefox browser environment, potentially leading to unauthorized access or control over browser functions and data. Given the high CVSS score and the nature of privilege escalation, the impact is considered high. However, there are no known exploits in the wild at this time.

Mozilla has released an official fix for this vulnerability in Firefox version 155. Users and administrators should update to Firefox 155 or later to mitigate this vulnerability. No additional mitigation actions are required beyond applying the official update.