CVE-2026-84123: Mozilla Firefox Use-After-Free Vulnerability

CVE-2026-84123 Overview

CVE-2026-84123 is a use-after-free vulnerability [CWE-416] in the Graphics: WebGPU component of Mozilla Firefox and Thunderbird. The flaw allows privilege escalation when a user loads attacker-controlled web content that exercises the WebGPU pipeline. Mozilla addressed the issue in Firefox 155, Firefox ESR 153.2, Thunderbird 155, and Thunderbird 153.2. The vulnerability is exploitable over the network and requires user interaction, such as visiting a crafted page.

Critical Impact
Successful exploitation allows an attacker to escalate privileges within the browser process, potentially leading to arbitrary code execution in the browser context.

Affected Products

Mozilla Firefox (versions prior to 155)
Mozilla Firefox ESR (versions prior to 153.2)
Mozilla Thunderbird (versions prior to 155 and prior to 153.2)

Discovery Timeline

2026-09-01 - CVE-2026-84123 published to NVD
2026-09-02 - Last updated in NVD database

Technical Details for CVE-2026-84123

Vulnerability Analysis

The vulnerability resides in the WebGPU implementation inside the Graphics component of Firefox and Thunderbird. WebGPU exposes GPU functionality to JavaScript in the browser, managing complex object lifetimes across the renderer and GPU process boundaries. A use-after-free condition occurs when the component references a graphics object after its backing memory has been released.

An attacker who controls the freed allocation can influence subsequent memory operations. This can corrupt internal state and redirect execution flow within the affected process. Because WebGPU is reachable from web content, the attack surface is broad and does not require prior authentication.

Root Cause

The defect is a classic use-after-free [CWE-416] tied to WebGPU resource management. An object is freed while a dangling reference remains in use elsewhere in the graphics pipeline. When the dangling pointer is dereferenced, memory that has been reallocated with attacker-controlled contents is treated as a valid object, breaking type and lifetime guarantees.

Attack Vector

Exploitation requires a victim to load malicious content in Firefox or open a crafted HTML message in Thunderbird where scripting is enabled. The attacker delivers JavaScript that invokes WebGPU APIs in a sequence designed to trigger the freed-object reuse. Successful exploitation elevates privileges within the browser process boundary, providing a foothold for further sandbox or renderer compromise.

No public proof-of-concept exploit or exploitation in the wild has been reported. See the Mozilla Bug Report #2060047 for technical details.

Detection Methods for CVE-2026-84123

Indicators of Compromise

Firefox or Thunderbird process crashes referencing WebGPU, wgpu, or Dawn modules in crash reports.
Unexpected renderer or GPU process restarts correlated with visits to untrusted domains.
Outbound connections from browser child processes to unfamiliar hosts shortly after page loads that invoke WebGPU.

Detection Strategies

Inventory endpoints for Firefox and Thunderbird versions and flag installations below Firefox 155, Firefox ESR 153.2, or Thunderbird 155/153.2.
Correlate browser crash telemetry with process behavior indicating post-exploitation activity such as child process spawning or credential access.
Hunt for anomalous script execution or file writes originating from browser processes in EDR telemetry.

Monitoring Recommendations

Ingest browser and OS crash logs into a central data lake to identify repeated WebGPU faults across the fleet.
Monitor process ancestry for firefox.exe or thunderbird.exe spawning shells, scripting hosts, or LOLBins.
Track network connections from browser processes to newly registered or low-reputation domains.

How to Mitigate CVE-2026-84123

Immediate Actions Required

Upgrade Firefox to version 155 or later on all managed endpoints.
Upgrade Firefox ESR deployments to 153.2 or later.
Upgrade Thunderbird to version 155 or 153.2, depending on the deployed release channel.
Restart browser and mail client processes after patch installation to ensure the vulnerable code is unloaded.

Patch Information

Mozilla has released fixed versions across all affected products. Refer to the vendor advisories for release notes and download links: Mozilla Security Advisory MFSA-2026-82, Mozilla Security Advisory MFSA-2026-85, Mozilla Security Advisory MFSA-2026-86, and Mozilla Security Advisory MFSA-2026-88.

Workarounds

Disable WebGPU in Firefox by setting dom.webgpu.enabled to false in about:config where an immediate upgrade is not feasible.
Configure Thunderbird to block remote content and disable JavaScript in mail display to reduce exposure.
Restrict access to untrusted websites through enterprise web filtering until patches are deployed.

bash

# Configuration example: disable WebGPU via Firefox enterprise policy (policies.json)
{
  "policies": {
    "Preferences": {
      "dom.webgpu.enabled": {
        "Value": false,
        "Status": "locked"
      }
    }
  }
}