CVE-2026-84144: Vulnerability in Mozilla Firefox

This vulnerability pertains to a set of internally discovered bugs in Mozilla Firefox 154 and Firefox ESR 153.1, some of which exhibit memory corruption or other security-relevant defects. The Mozilla security advisories MFSA 2026-82 and MFSA 2026-85 confirm that these bugs were fixed in Firefox 155 and Firefox ESR 153.2. The CVE is associated with CWE-119 (improper restriction of operations within the bounds of a memory buffer). The CVSS v3.1 base score is 7.5, indicating high severity, with attack vector network, high attack complexity, no privileges required, user interaction required, and impacts to confidentiality, integrity, and availability. No known exploits in the wild have been reported. The vendor advisories provide detailed references to multiple related bugs fixed in these releases.

The vulnerability could allow remote attackers to exploit memory corruption or other security defects in Firefox 154 and Firefox ESR 153.1, potentially leading to high-impact consequences including confidentiality, integrity, and availability breaches. However, exploitation requires user interaction and has high attack complexity. No active exploitation has been observed in the wild. The fixes in Firefox 155 and Firefox ESR 153.2 mitigate these risks.

Mozilla has released official fixes for these vulnerabilities in Firefox 155 and Firefox ESR 153.2. Users and administrators should update to these versions or later to remediate the issues. Since the vulnerabilities are fixed in these versions, no additional mitigation steps are required beyond applying the official updates. Patch status is confirmed by Mozilla advisories MFSA 2026-82 and MFSA 2026-85.