CVE-2026-84122: Mozilla Firefox Use-After-Free Vulnerability

CVE-2026-84122 Overview

CVE-2026-84122 is a use-after-free vulnerability [CWE-416] in the Audio/Video component of Mozilla Firefox and Thunderbird. The flaw allows an attacker to trigger memory reuse after it has been freed, potentially leading to memory corruption when a user loads specially crafted media content. Mozilla addressed the issue in Firefox 155, Firefox ESR 140.15, Firefox ESR 153.2, Thunderbird 155, Thunderbird 140.15, and Thunderbird 153.2. Exploitation requires user interaction, such as visiting a malicious page or opening a message containing media content.

Critical Impact
A remote attacker can trigger memory corruption through the Audio/Video component, resulting in limited confidentiality and integrity impact when a user interacts with malicious media content.

Affected Products

Mozilla Firefox (versions prior to 155)
Mozilla Firefox ESR (versions prior to 140.15 and 153.2)
Mozilla Thunderbird (versions prior to 155, 140.15, and 153.2)

Discovery Timeline

2026-09-01 - CVE CVE-2026-84122 published to NVD
2026-09-02 - Last updated in NVD database

Technical Details for CVE-2026-84122

Vulnerability Analysis

The vulnerability resides in the Audio/Video subsystem responsible for decoding and rendering media streams within Firefox and Thunderbird. A use-after-free condition occurs when the browser continues to reference a memory object after it has been released back to the heap. When an attacker crafts media content that triggers the specific object lifecycle mismatch, the freed memory region may be reallocated with attacker-influenced data before being dereferenced. The result is memory corruption that can affect process state and expose limited information to the attacker.

Root Cause

Use-after-free conditions [CWE-416] typically stem from incorrect reference counting, missing null-out of pointers after release, or race conditions between threads managing media object lifecycles. The Audio/Video pipeline in Gecko coordinates multiple asynchronous components, and a mismatch between object destruction and continued access is the underlying defect. Mozilla's security advisories provide additional context; see the Mozilla Bug Report #2059965.

Attack Vector

Exploitation is remote and requires user interaction. A user must visit a page containing malicious audio or video content, or in the case of Thunderbird, render a message that loads such content. The attack does not require authentication and can be delivered through standard web browsing or email preview workflows. Refer to Mozilla Security Advisory MFSA-2026-82 and related advisories for vendor-specific details.

No public proof-of-concept code is available for CVE-2026-84122. Technical details are described in prose only; consult the vendor advisories for reproduction context.

Detection Methods for CVE-2026-84122

Indicators of Compromise

Unexpected crashes of firefox.exe, firefox, or thunderbird processes with signatures pointing to media decoder frames.
Crash reporter submissions referencing the Audio/Video component or media pipeline modules.
Browser or mail client child process termination immediately after loading media content from untrusted origins.

Detection Strategies

Inventory endpoint Firefox and Thunderbird installations and compare against fixed versions (155, ESR 140.15, ESR 153.2).
Correlate web proxy or email gateway telemetry with browser crash events to identify potential exploitation attempts.
Monitor endpoint EDR telemetry for anomalous child processes or memory allocation patterns spawned by Firefox or Thunderbird after media rendering.

Monitoring Recommendations

Enable and centralize Mozilla crash reporting to identify recurring Audio/Video component failures.
Log outbound DNS and HTTP requests initiated by browser processes to flag unusual media content sources.
Track software version telemetry continuously so unpatched hosts are surfaced as new releases are deployed.

How to Mitigate CVE-2026-84122

Immediate Actions Required

Upgrade Firefox to version 155 or later, and Firefox ESR to 140.15 or 153.2 on all managed endpoints.
Upgrade Thunderbird to version 155, 140.15, or 153.2 depending on the deployed branch.
Prioritize patching for high-risk user populations such as executives, developers, and users who handle untrusted media.

Patch Information

Mozilla released fixes across multiple advisories including MFSA-2026-82, MFSA-2026-84, MFSA-2026-85, MFSA-2026-86, MFSA-2026-87, and MFSA-2026-88. Apply the update matching your deployed channel (release or ESR) as soon as testing permits.

Workarounds

Restrict autoplay of audio and video content in browser preferences to reduce exposure to malicious media.
Disable remote content loading in Thunderbird message preview until patches are deployed.
Use application allowlisting or content filtering at the network perimeter to limit access to untrusted media sources.

bash

# Verify installed Firefox version on Linux endpoints
firefox --version

# Verify installed Thunderbird version
thunderbird --version

# Windows PowerShell: query installed Firefox version
Get-ItemProperty "HKLM:\SOFTWARE\Mozilla\Mozilla Firefox" | Select-Object CurrentVersion