CVE-2026-84145: Vulnerability in Mozilla Firefox

CVE-2026-84145 covers a set of internally found bugs in Mozilla Firefox and Thunderbird products, including ESR versions. These bugs involve memory corruption and other security-relevant defects that could be exploited under certain conditions. The vulnerabilities were present in Firefox 154, Thunderbird 154, and ESR versions 115.39, 140.14, and 153.1. Mozilla fixed these issues in Firefox 155, Thunderbird 155, and ESR versions 115.40, 140.15, and 153.2. The CVSS 3.1 vector indicates network attack vector, high attack complexity, no privileges required, user interaction required, unchanged scope, and high impact on confidentiality, integrity, and availability. Multiple Mozilla security advisories (MFSA2026-82, MFSA2026-83, MFSA2026-84, MFSA2026-85) provide detailed information on these fixes. No active exploitation has been reported.

The vulnerabilities could allow attackers to exploit memory corruption and other security defects, potentially leading to privilege escalation, sandbox escape, information disclosure, or denial of service. The CVSS score of 7.5 reflects a high impact on confidentiality, integrity, and availability. However, no known exploits in the wild have been reported, and exploitation requires user interaction and has high attack complexity.

Mozilla has released official fixes for these vulnerabilities in Firefox 155, Thunderbird 155, and ESR versions 115.40, 140.15, and 153.2. Users and administrators should update to these versions or later to mitigate the risk. Patch status is confirmed by vendor advisories. No additional mitigation actions are required beyond applying the official updates.