CVE-2026-84142: Vulnerability in Mozilla Firefox

CVE-2026-84142 covers a set of internally discovered bugs in Mozilla Firefox 154 and Thunderbird 154, some showing evidence of memory corruption or other security-relevant defects that could potentially be exploited with sufficient effort. These include multiple high-impact vulnerabilities such as use-after-free bugs in various components (JavaScript GC, DOM navigation and security, Audio/Video, Graphics WebGPU), sandbox escapes, privilege escalations, information disclosures, and boundary condition errors. The vulnerabilities were fixed in Firefox 155 and Thunderbird 155, with detailed Mozilla advisories listing individual CVEs and their impacts. The CVSS v3.1 base score is 9.8 (critical), reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. No active exploitation has been observed. The vendor advisory explicitly states these bugs were fixed in the specified versions.

The vulnerabilities pose a critical risk due to potential memory corruption, privilege escalation, sandbox escapes, and information disclosure. Successful exploitation could lead to full compromise of the affected applications, impacting confidentiality, integrity, and availability. However, no known exploits in the wild have been reported. The issues affect core browser and email client components, potentially enabling attackers to bypass security boundaries or escalate privileges within the application context.

Mozilla has released official fixes for these vulnerabilities in Firefox 155 and Thunderbird 155. Users and administrators should update to these versions or later to mitigate the risks. Since these are internally found bugs fixed by the vendor, no additional mitigations are required beyond applying the official updates.