Mozjs52: [Unknown description] (CVE-2026-84144)

CVE-2026-84144 refers to a set of internally discovered bugs in Firefox 154 and Firefox ESR 153.1, including memory corruption and other security-relevant defects. These bugs could potentially be exploited with sufficient effort. The vulnerability was addressed and fixed in Firefox 155 and Firefox ESR 153.2. The affected product is mozjs52, the JavaScript engine component used in Firefox, with many specific Ubuntu package versions impacted. The CVSS 3.1 vector indicates a network attack vector with high attack complexity and user interaction required, resulting in high confidentiality, integrity, and availability impact. The Mozilla Foundation Security Advisory 2026-82 documents this fix along with other related vulnerabilities. No active exploitation has been observed. The vendor advisory is the authoritative source confirming the fix.

The vulnerability could allow an attacker to exploit memory corruption or other security defects to compromise confidentiality, integrity, and availability of the affected Firefox versions. The CVSS score of 7.5 reflects a medium severity with high impact on core security properties. However, exploitation requires user interaction and has high attack complexity. No known exploits in the wild have been reported, reducing immediate risk.

The vulnerability is fixed in Firefox 155 and Firefox ESR 153.2. Users and administrators should upgrade to these versions or later to remediate the issue. Since this is not a cloud service, manual patching is required. There are no indications that additional mitigation steps are needed beyond applying the official update.