CVE-2026-84131: Vulnerability in Mozilla Firefox

CVE-2026-84131 is a high-severity privilege escalation vulnerability due to an invalid pointer in the Graphics component of Mozilla Firefox. It affects Firefox and Thunderbird products prior to Firefox 155 and corresponding ESR versions. The vulnerability allows an attacker to escalate privileges, potentially leading to full compromise of the affected application. Mozilla has addressed this issue in Firefox 155, Firefox ESR 115.40, 140.15, 153.2, and Thunderbird versions 155, 140.15, and 153.2. The vulnerability is part of a broader set of security fixes released by Mozilla on September 1, 2026, as documented in multiple Mozilla Foundation Security Advisories (MFSA 2026-82, 83, 84, 85).

Successful exploitation of this vulnerability could allow an attacker to escalate privileges within the Firefox or Thunderbird process, potentially leading to unauthorized actions or code execution with elevated rights. The CVSS score of 8.8 reflects high impact on confidentiality, integrity, and availability. No active exploitation has been reported at this time.

Mozilla has released official fixes for this vulnerability in Firefox 155, Firefox ESR 115.40, 140.15, 153.2, and Thunderbird 155, 140.15, and 153.2. Users and administrators should update to these versions or later to remediate the vulnerability. Patch status is confirmed by the vendor advisories. No additional mitigation steps are required beyond applying these updates.