Mozjs52: [Unknown description] (CVE-2026-84139)

CVE-2026-84139 is a clickjacking issue within the DOM: Events component of Firefox, identified among several internally found bugs in Firefox 154 and fixed in Firefox 155. The vulnerability is part of a security advisory (Mozilla Foundation Security Advisory 2026-82) that addresses multiple high-impact security defects including use-after-free, privilege escalation, sandbox escapes, and information disclosure. The advisory confirms these bugs showed evidence of memory corruption or other security-relevant defects that could potentially be exploited with sufficient effort. The vulnerability affects numerous specific versions of mozjs52 and Firefox packages distributed on Ubuntu LTS versions 18.04 through 24.04. The CVSS 3.1 score is 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating network attack vector, low attack complexity, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability. No exploits in the wild are currently known.

The vulnerability allows an attacker to perform clickjacking attacks via the DOM Events component, potentially leading to unauthorized actions or privilege escalation. Given the CVSS score of 9.8, the impact on confidentiality, integrity, and availability is high if exploited. However, no active exploitation has been reported. This vulnerability is part of a set of critical security issues fixed in Firefox 155, which collectively address memory corruption and other security defects.

A security update fixing this vulnerability is available in Firefox 155. Users and administrators should upgrade to Firefox 155 or later to remediate this issue. Since this is not a cloud service, manual patching is required. There are no vendor advisories indicating that no action is required or that the issue is already mitigated. Patch status is confirmed by the Mozilla Foundation Security Advisory 2026-82.