CVE-2026-84120 Overview
CVE-2026-84120 is a use-after-free vulnerability in the Audio/Video component of Mozilla Firefox and Thunderbird. The flaw allows an attacker to trigger memory corruption when a user interacts with specially crafted media content. Successful exploitation could lead to limited disclosure of process memory or integrity impact within the affected browser process. Mozilla has fixed the issue in Firefox 155, Firefox ESR 115.40, Firefox ESR 140.15, Firefox ESR 153.2, Thunderbird 155, Thunderbird 140.15, and Thunderbird 153.2.
Critical Impact
Network-based use-after-free ([CWE-416]) in media handling code that requires user interaction and can corrupt process memory in Firefox and Thunderbird.
Affected Products
- Mozilla Firefox prior to version 155
- Mozilla Firefox ESR prior to 115.40, 140.15, and 153.2
- Mozilla Thunderbird prior to 155, 140.15, and 153.2
Discovery Timeline
- 2026-09-01 - CVE-2026-84120 published to NVD
- 2026-09-02 - Last updated in NVD database
Technical Details for CVE-2026-84120
Vulnerability Analysis
The vulnerability is a use-after-free condition ([CWE-416]) in the Audio/Video component shared by Firefox and Thunderbird. Use-after-free flaws occur when code continues to reference memory that has already been released back to the allocator. In media pipelines, this typically arises when playback state, decoder objects, or media stream references are freed on one execution path while another code path retains a stale pointer.
An attacker delivering crafted media content over the network can influence allocation and release ordering to reclaim the freed object with attacker-controlled data. The reused allocation can then be dereferenced by the media component, producing memory corruption inside the content process. Mozilla's public advisory rates the disclosure and integrity impact as limited and requires user interaction, consistent with a media playback trigger rather than a passive network probe.
Root Cause
The root cause is improper lifetime management of an object inside the Audio/Video subsystem. Mozilla has not published exploitation details, but the fix appears in Firefox 155, Firefox ESR 115.40, 140.15, and 153.2, and the corresponding Thunderbird releases. Refer to Mozilla Bug Report #2058911 for tracking information.
Attack Vector
Exploitation requires a victim to load attacker-controlled content in Firefox or open a message in Thunderbird that triggers media parsing. A malicious page or email can embed the crafted audio or video resource. No authentication is required, but user interaction is needed to initiate rendering. See Mozilla Security Advisory MFSA-2026-84 for the vendor's technical summary.
Mozilla has not released proof-of-concept code, and no public exploit is currently available. The vulnerability mechanism is described in prose only because verified exploitation code has not been published.
Detection Methods for CVE-2026-84120
Indicators of Compromise
- Unexpected crashes of firefox.exe, thunderbird.exe, or the plugin-container process on Linux and macOS, with crash signatures referencing media decoding modules.
- Browser or mail client crash telemetry showing repeated faults during playback of remote audio or video content.
- Outbound network requests to unfamiliar domains immediately preceding a content process crash.
Detection Strategies
- Inventory endpoints running Firefox and Thunderbird and compare installed versions against the fixed builds published in Mozilla Security Advisories MFSA-2026-82 through MFSA-2026-88.
- Correlate browser crash events with recent web navigation or email rendering activity to identify suspicious media triggers.
- Hunt for anomalous child-process activity spawned by Firefox or Thunderbird following media playback, which can indicate post-exploitation attempts.
Monitoring Recommendations
- Forward Windows Application, Linux systemd-coredump, and macOS ReportCrash events to a centralized log platform for correlation.
- Enable EDR telemetry on browser processes and alert on unexpected memory access violations or exception codes such as 0xC0000005 originating from media libraries.
- Track version metadata from software inventory tools and flag hosts that remain on vulnerable Firefox or Thunderbird builds.
How to Mitigate CVE-2026-84120
Immediate Actions Required
- Upgrade Firefox to version 155 and Thunderbird to version 155 on all managed endpoints.
- Update ESR channels to Firefox ESR 115.40, 140.15, or 153.2, and Thunderbird 140.15 or 153.2 as appropriate.
- Restart the browser and mail client after patch deployment to ensure the vulnerable code is unloaded.
Patch Information
Mozilla addressed CVE-2026-84120 in Firefox 155, Firefox ESR 115.40, Firefox ESR 140.15, Firefox ESR 153.2, Thunderbird 155, Thunderbird 140.15, and Thunderbird 153.2. Full vendor details are available in Mozilla Security Advisory MFSA-2026-82, MFSA-2026-83, MFSA-2026-84, MFSA-2026-85, MFSA-2026-86, MFSA-2026-87, and MFSA-2026-88.
Workarounds
- Disable automatic media playback and restrict autoplay via enterprise policy until patches are deployed.
- Configure Thunderbird to render messages as plain text and block remote content by default to reduce exposure to malicious media.
- Apply network egress filtering to limit browser and mail client access to untrusted media hosting domains during the patch window.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
