CVE-2026-84132: Vulnerability in Mozilla Firefox

CVE-2026-84132 is an information disclosure vulnerability classified under CWE-200 affecting the Networking: HTTP component of Mozilla Firefox. The vulnerability allows an attacker to gain access to sensitive information due to improper handling in the HTTP networking stack. It was identified internally and fixed in Firefox 155 and Firefox ESR 153.2. The CVSS v3.1 base score is 7.5, indicating high severity with network attack vector, low attack complexity, no privileges required, no user interaction, and high confidentiality impact. Mozilla's official security advisories MFSA 2026-82 and MFSA 2026-85 confirm the fix and recommend upgrading to these versions. There are no reports of active exploitation in the wild.

Successful exploitation of this vulnerability could lead to unauthorized disclosure of sensitive information via the HTTP networking component in Firefox. The confidentiality impact is high, but integrity and availability are not affected. No known active exploits have been reported, reducing immediate risk. However, the high CVSS score indicates that the vulnerability could be leveraged remotely without privileges or user interaction to leak information.

Mozilla has fixed this vulnerability in Firefox 155 and Firefox ESR 153.2. Users and administrators should update to these versions or later to remediate the issue. No additional mitigations are required as the vendor advisory confirms the availability of an official fix.