CVE-2026-84143: Vulnerability in Mozilla Firefox

CVE-2026-84143 covers a set of internally discovered bugs in Mozilla Firefox and Thunderbird products, including Firefox 154, Firefox ESR 153.1, and Firefox ESR 140.14. These bugs showed evidence of memory corruption or other security-relevant defects, which could potentially be exploited. The vulnerabilities were addressed and fixed in Firefox 155, Firefox ESR 153.2, Firefox ESR 140.15, Thunderbird 155, Thunderbird 153.2, and Thunderbird 140.15. The CVSS score of 9.8 reflects critical severity with network attack vector, low attack complexity, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability. The vendor advisories confirm these fixes and provide detailed references to individual bugs and their impact levels.

The vulnerabilities could allow remote attackers to exploit memory corruption or other security defects, potentially leading to full compromise of confidentiality, integrity, and availability of the affected Firefox and Thunderbird versions. The critical CVSS score of 9.8 indicates that these flaws are severe and could be exploited without user interaction or privileges. However, no known exploits in the wild have been reported at this time.

The vulnerabilities have been fixed by Mozilla in Firefox 155, Firefox ESR 153.2, Firefox ESR 140.15, Thunderbird 155, Thunderbird ESR 153.2, and Thunderbird ESR 140.15. Users and administrators should update to these fixed versions or later to mitigate the risk. Patch status is confirmed by Mozilla vendor advisories. No additional mitigation actions are required beyond applying these official updates.