CVE-2026-84119: Mozilla Firefox Use-After-Free Vulnerability

CVE-2026-84119 Overview

CVE-2026-84119 is a use-after-free vulnerability in the DOM: Navigation component of Mozilla Firefox and Thunderbird. The flaw allows an attacker to escape the browser sandbox after a user visits a crafted web page. Mozilla addressed the issue across seven security advisories covering the current release channel and multiple Extended Support Release (ESR) branches. The vulnerability is classified as [CWE-416] Use After Free and affects the memory-safety boundary that isolates content processes from privileged browser operations.

Critical Impact
A successful exploit can break out of the Firefox content sandbox, giving an attacker code execution in a more privileged process after a single crafted page visit.

Affected Products

Mozilla Firefox prior to version 155
Mozilla Firefox ESR prior to 115.40, 140.15, and 153.2
Mozilla Thunderbird prior to 155, 140.15, and 153.2

Discovery Timeline

2026-09-01 - CVE-2026-84119 published to NVD
2026-09-02 - Last updated in NVD database

Technical Details for CVE-2026-84119

Vulnerability Analysis

The vulnerability resides in the DOM Navigation component, which manages document lifecycle transitions between pages, history entries, and navigations initiated from script. A use-after-free condition occurs when memory referenced by an internal navigation object is released but a dangling pointer is later dereferenced during subsequent DOM operations.

Because the affected code path runs in a context that interacts with privileged browser interfaces, a controlled reuse of the freed allocation allows an attacker to influence object layout and virtual dispatch. This turns a memory-safety error into a sandbox escape rather than a simple content-process crash. The impact spans Firefox, Firefox ESR, and Thunderbird, which shares the Gecko rendering engine.

Root Cause

The root cause is improper lifetime management of a navigation-related object [CWE-416]. Code retains a pointer to a heap allocation after ownership has been released, then reuses that pointer during a follow-up DOM event. The condition is reachable through JavaScript-driven navigation and history manipulation available to any origin.

Attack Vector

Exploitation requires the victim to load attacker-controlled HTML or open a crafted message that renders remote content. No authentication is required. The attack is remote over the network and combines a heap-grooming primitive with the use-after-free to gain code execution outside the content sandbox. For Thunderbird, the risk is limited when remote content in messages is disabled, but any browsing-style workflow that renders HTML remains exposed.

No verified public proof-of-concept is available. See the Mozilla Bug Report #2057817 for restricted technical details.

Detection Methods for CVE-2026-84119

Indicators of Compromise

Firefox or Thunderbird plugin-container or content processes spawning unexpected child processes such as cmd.exe, powershell.exe, or /bin/sh.
Unexpected file writes to user-profile or startup directories immediately after a browsing session.
Outbound connections from browser child processes to non-web infrastructure over non-standard ports.

Detection Strategies

Inventory installed Firefox and Thunderbird versions and flag hosts running builds older than Firefox 155, Firefox ESR 115.40/140.15/153.2, or Thunderbird 155/140.15/153.2.
Alert on browser processes performing parent-child relationships inconsistent with normal rendering activity, particularly script interpreter launches.
Correlate browser crash telemetry with subsequent process creation or persistence events on the same host.

Monitoring Recommendations

Collect EDR process-tree telemetry for firefox.exe, thunderbird.exe, and their content child processes.
Ingest browser crash reports and Windows Error Reporting events into the SIEM to surface repeated Gecko renderer crashes.
Monitor egress traffic from browser processes and baseline expected destinations.

How to Mitigate CVE-2026-84119

Immediate Actions Required

Upgrade Firefox to version 155 or later on all managed endpoints.
Upgrade Firefox ESR deployments to 115.40, 140.15, or 153.2 depending on the active ESR channel.
Upgrade Thunderbird to 155, 140.15, or 153.2 and disable rendering of remote content in messages until patching is complete.

Patch Information

Mozilla published fixes in the following advisories: MFSA-2026-82, MFSA-2026-83, MFSA-2026-84, MFSA-2026-85, MFSA-2026-86, MFSA-2026-87, and MFSA-2026-88. Administrators should validate that the deployed build matches or exceeds the fixed version for each channel.

Workarounds

Restrict access to untrusted web content through enterprise browsing policies and network-level URL filtering.
Disable HTML rendering and remote content loading in Thunderbird message display until the update is applied.
Deploy application allowlisting to prevent browser child processes from launching script interpreters and other living-off-the-land binaries.

bash

# Verify installed Firefox version on Linux endpoints
firefox --version

# Windows: query installed version via registry
reg query "HKLM\SOFTWARE\Mozilla\Mozilla Firefox" /v CurrentVersion

# Thunderbird: disable remote content in messages (user.js)
user_pref("mailnews.message_display.disable_remote_image", true);