Mozjs52: [Unknown description] (CVE-2026-84137)
Description
CVE-2026-84137 is a spoofing vulnerability in the DOM: Core & HTML component of Mozilla Firefox. It was identified as a low impact issue and fixed in Firefox version 155. The vulnerability was internally found and is part of a set of security fixes addressing various memory corruption and security-relevant defects in Firefox 154 and ESR versions. The CVSS score is 9.8, indicating a high severity rating, but the vendor advisory classifies the impact of this specific issue as low. Multiple affected Ubuntu package versions of mozjs52 are listed, but the vulnerability is resolved in Firefox 155.
CVSS v3.1
Score 9.8critical
Affected software
pkg:deb/ubuntu/mozjs52?arch=source&distro=bionicpkg:deb/ubuntu/mozjs38?arch=source&distro=bionicpkg:deb/ubuntu/mozjs68?arch=source&distro=focalpkg:deb/ubuntu/mozjs52?arch=source&distro=focalpkg:deb/ubuntu/mozjs102?arch=source&distro=jammypkg:deb/ubuntu/mozjs78?arch=source&distro=jammypkg:deb/ubuntu/mozjs91?arch=source&distro=jammypkg:deb/ubuntu/thunderbird?arch=source&distro=jammypkg:deb/ubuntu/mozjs102?arch=source&distro=noblepkg:deb/ubuntu/mozjs115?arch=source&distro=nobleRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-84137 is a spoofing issue in the DOM: Core & HTML component of Firefox, discovered internally and fixed in Firefox 155. The Mozilla advisory groups this vulnerability among several others fixed in Firefox 155, which address memory corruption and other security defects. Although the CVSS score is high (9.8), the advisory assigns a low impact to this specific vulnerability. The affected product is mozjs52, with numerous Ubuntu package versions impacted. The vulnerability is resolved by upgrading to Firefox 155 or later.
Potential Impact
The vulnerability allows spoofing in the DOM Core & HTML component, which could potentially mislead users or scripts by presenting falsified content or behavior. The vendor rates the impact as low for this specific issue, despite the overall CVSS score of 9.8. No known exploits are reported in the wild. The vulnerability is part of a broader set of security fixes addressing memory corruption and privilege escalation issues in Firefox 155.
Mitigation Recommendations
A fix is available and included in Firefox 155. Users and administrators should upgrade to Firefox 155 or later to remediate this vulnerability. Since this is an internally found bug fixed by the vendor, no additional mitigation steps are required beyond applying the official update.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- UBUNTU-CVE-2026-84137
- Osv Schema Version
- 1.7.0
- Ecosystems
- ["Ubuntu:18.04:LTS","Ubuntu:20.04:LTS","Ubuntu:22.04:LTS","Ubuntu:24.04:LTS"]
- Cvss Version
- 3.1
Threat ID: 6a9c2594acd9273b49fbb287
Added to database: 09/05/2026, 14:22:12 UTC
Last enriched: 09/07/2026, 14:55:48 UTC
Last updated: 10/19/2026, 06:48:20 UTC
Views: 52
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.