CVE-2026-84118: Mozilla Firefox Use-After-Free Vulnerability

CVE-2026-84118 Overview

CVE-2026-84118 is a use-after-free vulnerability [CWE-416] in the JavaScript garbage collector (GC) component shared by Mozilla Firefox and Mozilla Thunderbird. An attacker who convinces a user to load specially crafted web content can trigger reuse of freed memory during garbage collection. Successful exploitation may lead to memory disclosure or integrity issues within the browser process. Mozilla addressed the flaw in Firefox 155, Firefox ESR 153.2, Thunderbird 155, and Thunderbird 153.2.

Critical Impact
Remote content processed by the JavaScript engine can trigger use-after-free conditions, exposing confidentiality and integrity of the browser process to a network-based attacker with user interaction.

Affected Products

Mozilla Firefox prior to 155
Mozilla Firefox ESR prior to 153.2
Mozilla Thunderbird prior to 155 and prior to 153.2

Discovery Timeline

2026-09-01 - CVE-2026-84118 published to NVD
2026-09-02 - Last updated in NVD database

Technical Details for CVE-2026-84118

Vulnerability Analysis

The defect lives in the SpiderMonkey JavaScript engine's garbage collector. During a GC cycle, an object reference remains reachable after its backing memory has been reclaimed. Subsequent JavaScript operations dereference that stale pointer and operate on memory that has been reallocated for another purpose.

This class of bug commonly enables limited information disclosure and heap-state manipulation. The advisory scope indicates confidentiality and integrity impact without direct availability loss, consistent with a use-after-free that leaks or corrupts specific object fields rather than crashing the process outright. User interaction is required, meaning the target must open or render attacker-controlled content such as a web page or an HTML email that executes script.

Root Cause

The root cause is improper lifetime tracking between the GC and code paths that hold raw pointers to managed objects. When the collector frees an object that a caller still references, the caller performs operations on freed memory. Mozilla resolved the issue by correcting the object rooting or barrier logic in the affected GC path, as tracked in Mozilla Bug Report #2057457.

Attack Vector

Exploitation requires a user to load attacker-controlled web content in a vulnerable Firefox or Thunderbird build. In Thunderbird, remote content rendering is typically disabled by default in messages, which reduces exposure but does not eliminate it when scripting contexts are reachable. The attacker delivers a crafted page or document that manipulates the JavaScript heap and forces the vulnerable GC state.

No public proof-of-concept or in-the-wild exploitation has been reported, and the flaw is not listed in the CISA Known Exploited Vulnerabilities catalog. Refer to Mozilla Security Advisory MFSA-2026-82 and related advisories for technical context.

Detection Methods for CVE-2026-84118

Indicators of Compromise

Firefox or Thunderbird process crashes with signatures referencing js::gc or SpiderMonkey collector frames.
Unexpected child process terminations tied to content rendering after visiting untrusted sites or opening HTML mail.
Endpoint telemetry showing browser processes spawning shell or scripting binaries following renderer instability.

Detection Strategies

Inventory installed Firefox, Firefox ESR, and Thunderbird versions across managed endpoints and flag builds below 155 or ESR 153.2.
Correlate browser crash reports with recent navigation history to identify potential exploitation attempts.
Monitor for outbound connections from browser processes to newly registered domains immediately following crash events.

Monitoring Recommendations

Ingest endpoint process, module, and crash telemetry into a central analytics platform for retrospective hunting.
Alert on abnormal child processes originating from firefox.exe, firefox, or thunderbird binaries.
Track patch compliance for Mozilla products through vulnerability management dashboards.

How to Mitigate CVE-2026-84118

Immediate Actions Required

Update Firefox to version 155 or later, and Firefox ESR to 153.2 or later, across all managed systems.
Update Thunderbird to version 155 or 153.2 or later on all workstations that process email.
Restart browser and mail client processes after patch deployment to ensure the vulnerable code path is unloaded.

Patch Information

Mozilla shipped fixes in Firefox 155, Firefox ESR 153.2, Thunderbird 155, and Thunderbird 153.2. Deployment guidance is available in Mozilla Security Advisory MFSA-2026-85, MFSA-2026-86, and MFSA-2026-88.

Workarounds

Disable JavaScript for untrusted contexts using enterprise policy, accepting site compatibility trade-offs.
Keep the default Thunderbird setting that blocks remote content and scripting in email messages.
Restrict browsing on high-value systems to a curated allow list until patches are fully deployed.

bash

# Verify installed Firefox version on Linux endpoints
firefox --version

# Verify installed Thunderbird version
thunderbird --version

# Example enterprise policy fragment (policies.json) to enforce updates
# Place at /etc/firefox/policies/policies.json or the platform equivalent
{
  "policies": {
    "DisableAppUpdate": false,
    "AppAutoUpdate": true
  }
}