CVE-2026-84117: Firefox Mobile Privilege Escalation Flaw

CVE-2026-84117 Overview

CVE-2026-84117 is a privilege escalation vulnerability in Mozilla Firefox for Android. The flaw affects Firefox Mobile versions prior to 155 and stems from improper access control [CWE-284]. An attacker can leverage the vulnerability over the network with user interaction to gain elevated privileges within the browser context on Android devices. Mozilla addressed the issue in Firefox 155 through security advisory MFSA-2026-82.

Critical Impact
Successful exploitation lets a remote attacker escalate privileges within Firefox for Android, compromising confidentiality, integrity, and availability of browser-managed data on the device.

Affected Products

Mozilla Firefox for Android versions prior to 155
Android platform installations of mozilla:firefox_mobile
Users on unpatched Firefox Mobile builds distributed through Android channels

Discovery Timeline

2026-09-01 - CVE-2026-84117 published to the National Vulnerability Database (NVD)
2026-09-03 - Last updated in NVD database
2026-09-03 - EPSS probability recorded at 0.249%

Technical Details for CVE-2026-84117

Vulnerability Analysis

The vulnerability is a privilege escalation issue in Firefox for Android tracked under Mozilla Security Advisory MFSA-2026-82. It falls under the Improper Access Control weakness class [CWE-284]. The flaw allows a remote attacker to elevate privileges inside the browser process when a user interacts with attacker-controlled content.

The attack is delivered over the network, meaning a crafted web page or hosted resource can trigger the condition. Because Firefox Mobile brokers permissions between web contexts, native Android components, and internal browser features, an access-control gap here can let untrusted content reach operations reserved for privileged code paths.

Root Cause

The root cause is improper enforcement of access-control boundaries within Firefox for Android [CWE-284]. Mozilla's advisory identifies the defect as a privilege escalation condition fixed in Firefox 155. Further implementation-level details are tracked in Mozilla Bug Report #2053320, which is referenced by the vendor advisory.

Attack Vector

Exploitation requires network delivery and user interaction, consistent with a browser-based privilege escalation. A victim must load or interact with content controlled by the attacker, such as a malicious page, a redirect chain, or an embedded resource. Once the flow is triggered, the attacker gains elevated access within the Firefox for Android process, which can be used to reach data or capabilities that should be gated by the browser's permission model. No public proof-of-concept, exploit code, or CISA KEV listing exists for this CVE at time of publication.

No verified public code is available. Refer to the Mozilla Security Advisory MFSA-2026-82 for authoritative technical detail.

Detection Methods for CVE-2026-84117

Indicators of Compromise

Firefox for Android installations reporting a version earlier than 155 in mobile device management (MDM) inventories
Unexpected changes to Firefox browser permissions, site data, or extension state on managed Android devices
Outbound connections from Firefox Mobile to newly registered or low-reputation domains immediately following a click on a shared link

Detection Strategies

Query mobile inventory and MDM data to enumerate Android devices running Firefox versions below 155.
Correlate web proxy or DNS telemetry with mobile browsing activity to flag access to URLs associated with malicious redirect chains.
Baseline Firefox Mobile process behavior and alert on anomalous permission grants or storage access patterns after page loads.

Monitoring Recommendations

Ingest MDM and endpoint telemetry into a central analytics platform to track Firefox for Android patch status across the fleet.
Monitor Mozilla's advisory channel for updates to MFSA-2026-82 and related bug tracking.
Track EPSS score changes for CVE-2026-84117 to detect a shift from low exploitation likelihood to active targeting.

How to Mitigate CVE-2026-84117

Immediate Actions Required

Update Firefox for Android to version 155 or later on all managed and BYOD Android devices.
Enforce a minimum Firefox Mobile version through MDM compliance policies and block noncompliant devices from sensitive resources.
Notify users to avoid clicking untrusted links in messaging apps, email, and social media until the update is confirmed installed.

Patch Information

Mozilla fixed CVE-2026-84117 in Firefox for Android version 155. The fix is documented in Mozilla Security Advisory MFSA-2026-82 with tracking details in Mozilla Bug Report #2053320. Install the update through the Google Play Store or the enterprise distribution channel used to manage Android browsers.

Workarounds

Restrict use of Firefox for Android on managed devices to an alternate patched browser until version 155 is deployed.
Disable automatic loading of untrusted content by enforcing strict content filtering at the network egress and DNS layers.
Educate users to close and not interact with unexpected prompts or redirects encountered while browsing on Android.

bash

# Example: enforce minimum Firefox for Android version via MDM compliance rule
# Pseudocode for an MDM policy expression
app.package = "org.mozilla.firefox"
app.minVersion = "155"
action.onNonCompliance = "block_corporate_access"