Mozjs52: [Unknown description] (CVE-2026-84143)

CVE-2026-84143 refers to a set of internally discovered bugs present in Firefox 154, Firefox ESR 153.1, and Firefox ESR 140.14. These bugs showed evidence of memory corruption or other security-relevant defects that could be exploited with sufficient effort. The Mozilla Foundation fixed these issues in Firefox 155, Firefox ESR 153.2, and Firefox ESR 140.15. The vulnerability affects the mozjs52 component as packaged in various Ubuntu versions. The CVSS 3.1 score is 9.8, with vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, indicating network attack vector, low attack complexity, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability.

The vulnerability could allow an attacker to exploit memory corruption or other security defects to compromise the confidentiality, integrity, and availability of the affected system. Given the CVSS score of 9.8, the impact is critical, potentially enabling remote code execution or complete system compromise without user interaction or privileges. However, no known exploits in the wild have been reported at this time.

The vulnerability is fixed in Firefox 155 and corresponding ESR releases (153.2, 140.15). Users and administrators should update to these fixed versions or later. Since this is not a cloud service, patching the affected software is required to remediate the issue. No vendor advisory indicates that no action is required or that the issue is already mitigated without patching.