CVE-2026-84121: Mozilla Firefox Use-After-Free Vulnerability

CVE-2026-84121 Overview

CVE-2026-84121 is a use-after-free vulnerability [CWE-416] in the DOM: Security component of Mozilla Firefox and Thunderbird. The flaw allows an attacker to escape the browser sandbox, breaking one of the primary defense-in-depth boundaries between untrusted web content and the host operating system. Mozilla addressed the issue in Firefox 155, Firefox ESR 115.40, Firefox ESR 140.15, Firefox ESR 153.2, Thunderbird 155, Thunderbird 140.15, and Thunderbird 153.2. Exploitation requires user interaction, typically by rendering a crafted web page in an affected client.

Critical Impact
A successful sandbox escape enables adversaries to execute code outside the constrained renderer process, chaining to full host compromise when combined with a content-process bug.

Affected Products

Mozilla Firefox versions prior to 155
Mozilla Firefox ESR versions prior to 115.40, 140.15, and 153.2
Mozilla Thunderbird versions prior to 155, 140.15, and 153.2

Discovery Timeline

2026-09-01 - CVE-2026-84121 published to NVD
2026-09-02 - Last updated in NVD database

Technical Details for CVE-2026-84121

Vulnerability Analysis

The vulnerability is a use-after-free condition within the DOM: Security component of Gecko. A use-after-free occurs when code references memory after that memory has been released, allowing an attacker who controls subsequent allocations to place attacker-shaped data at the freed address. In this case, the object involved participates in security-relevant DOM operations, and its premature release creates a dangling pointer that can be reclaimed by attacker-controlled content. Exploitation results in a sandbox escape rather than a simple renderer crash, meaning code execution can leave the constrained child process and act with the privileges of the parent browser process.

Root Cause

The root cause is improper lifetime management of a DOM security object. The referencing code retains a raw pointer or weak reference after the underlying object has been destroyed, violating the ownership contract enforced elsewhere in the DOM implementation. Full technical details are tracked in Mozilla Bug Report #2059018.

Attack Vector

The attack vector is network-based and requires user interaction. An attacker hosts or injects malicious HTML and JavaScript into a page that the victim loads in a vulnerable Firefox or Thunderbird build. The page triggers the vulnerable DOM code path, sprays the heap to reclaim the freed allocation, and pivots control flow to escape the content-process sandbox. Thunderbird is affected when remote content is rendered in the mail client. See the Mozilla Security Advisory MFSA-2026-82 and MFSA-2026-88 for advisory-level detail.

No verified public proof-of-concept code is available for CVE-2026-84121.
Refer to Mozilla Bug #2059018 for restricted technical details.

Detection Methods for CVE-2026-84121

Indicators of Compromise

Unexpected crashes or restarts of firefox.exe, firefox, or thunderbird processes correlated with browsing activity
Child content processes spawning non-browser executables such as shells, powershell.exe, or cmd.exe
Outbound connections from the browser parent process to unfamiliar domains shortly after visiting a page
Presence of Firefox or Thunderbird binaries at versions below the fixed releases listed in the Mozilla advisories

Detection Strategies

Inventory endpoints for Firefox and Thunderbird builds older than Firefox 155, Firefox ESR 115.40/140.15/153.2, and Thunderbird 155/140.15/153.2.
Alert on browser child processes executing living-off-the-land binaries or writing to autorun locations.
Correlate browser crash telemetry with subsequent process-injection or persistence events on the same host.

Monitoring Recommendations

Ingest endpoint process-creation and network telemetry into a centralized analytics platform and pivot on parent_process == firefox|thunderbird.
Track user-agent strings and browser versions from web-proxy logs to identify unpatched clients still active on the network.
Monitor Mozilla's advisory feed for related follow-on fixes referenced under MFSA-2026-82 through MFSA-2026-88.

How to Mitigate CVE-2026-84121

Immediate Actions Required

Update Firefox to version 155 or later on all managed endpoints.
Update Firefox ESR deployments to 115.40, 140.15, or 153.2 depending on the supported ESR channel.
Update Thunderbird to 155, 140.15, or 153.2 to remediate the mail client exposure.
Force browser restarts through management tooling to ensure patched binaries are loaded into memory.

Patch Information

Mozilla has released fixed builds tracked across seven advisories: MFSA-2026-82, MFSA-2026-83, MFSA-2026-84, MFSA-2026-85, MFSA-2026-86, MFSA-2026-87, and MFSA-2026-88. Apply the update matching the branch deployed in your environment.

Workarounds

Disable JavaScript on untrusted origins where operationally feasible until patches are applied.
Configure Thunderbird to block remote content in messages to reduce the attack surface for the mail client.
Route browser traffic through a filtering proxy that blocks known malicious or newly registered domains.

bash

# Verify installed Firefox version on Linux endpoints
firefox --version

# Verify installed Thunderbird version
thunderbird --version

# Example enterprise policy snippet to enforce automatic updates (policies.json)
{
  "policies": {
    "DisableAppUpdate": false,
    "AppAutoUpdate": true
  }
}