CVE-2026-84125: Mozilla Firefox Use-After-Free Vulnerability

CVE-2026-84125 Overview

CVE-2026-84125 is a use-after-free vulnerability [CWE-416] in the DOM: Core & HTML component shared by Mozilla Firefox and Mozilla Thunderbird. The flaw allows an attacker who convinces a user to load crafted web content to trigger memory corruption in the browser process. Successful exploitation can lead to limited disclosure of process memory or minor integrity impact within the affected renderer. Mozilla fixed the issue in Firefox 155, Firefox ESR 153.2, Thunderbird 155, and Thunderbird 153.2.

Critical Impact
Remote attackers can trigger memory corruption in the browser DOM engine through crafted web content, potentially leading to information disclosure or integrity impact after user interaction.

Affected Products

Mozilla Firefox versions prior to 155
Mozilla Firefox ESR versions prior to 153.2
Mozilla Thunderbird versions prior to 155 and prior to 153.2

Discovery Timeline

2026-09-01 - CVE-2026-84125 published to NVD
2026-09-02 - Last updated in NVD database

Technical Details for CVE-2026-84125

Vulnerability Analysis

The vulnerability resides in the DOM: Core & HTML component that Firefox and Thunderbird share through the Gecko engine. A use-after-free condition occurs when the engine references a DOM object after its backing memory has been freed. Attackers can influence object lifetimes during script-driven DOM manipulation to reach the freed allocation. The condition requires user interaction, typically loading an attacker-controlled page or HTML email content rendered by Thunderbird.

Mozilla assigned the issue across four advisories covering the desktop and ESR release trains: MFSA-2026-82, MFSA-2026-85, MFSA-2026-86, and MFSA-2026-88. The EPSS probability of 0.164% indicates low observed exploitation likelihood at publication.

Root Cause

The root cause is improper lifetime management of DOM objects in the Core & HTML subsystem. Code paths dereference a pointer to an object that has already been released, satisfying the pattern described by CWE-416: Use After Free. Precise object types and reachable call paths are tracked in Mozilla Bug #2063871.

Attack Vector

Exploitation requires an attacker to serve crafted HTML, script, or DOM content to a vulnerable client. In Firefox, this is typically achieved by convincing a user to visit a malicious or compromised site. In Thunderbird, remote content rendering within messages can serve as an equivalent trigger when scripting-adjacent DOM handling paths are reached. No authentication is required, and the attack is network-reachable, but user interaction is necessary to load the content.

Refer to the Mozilla Bug #2063871 tracking record for reproduction context.

Detection Methods for CVE-2026-84125

Indicators of Compromise

Unexpected Firefox or Thunderbird process crashes with signatures pointing to DOM allocator or garbage collection frames.
Browser telemetry showing repeated tab or content-process restarts after visits to specific untrusted domains.
Outbound network connections initiated by firefox.exe or thunderbird.exe to previously unseen hosts shortly after crash events.

Detection Strategies

Inventory endpoint browser and mail client versions and flag hosts running Firefox below 155, Firefox ESR below 153.2, or Thunderbird below 155 / 153.2.
Correlate Windows Error Reporting, macOS CrashReporter, or Linux coredumpctl records for Gecko-based processes with recent web navigation events.
Monitor EDR telemetry for child process creation or memory injection originating from Firefox or Thunderbird content processes.

Monitoring Recommendations

Ingest browser and mail client crash logs into a central data lake for correlation with URL and email metadata.
Alert on anomalous script execution or file writes performed by browser child processes following the rendering of external content.
Track patch deployment coverage for Mozilla products across managed endpoints on a weekly cadence.

How to Mitigate CVE-2026-84125

Immediate Actions Required

Upgrade Firefox to 155 or later, Firefox ESR to 153.2 or later, and Thunderbird to 155 or 153.2 or later.
Enable automatic updates for Mozilla products across managed endpoints to reduce exposure windows.
Restrict rendering of remote content in Thunderbird until patched builds are deployed.

Patch Information

Mozilla addressed the vulnerability in Firefox 155, Firefox ESR 153.2, Thunderbird 155, and Thunderbird 153.2. Deployment guidance and package details are available in Mozilla Security Advisory MFSA-2026-82, MFSA-2026-85, MFSA-2026-86, and MFSA-2026-88.

Workarounds

Disable JavaScript for untrusted origins using enterprise policy where operationally feasible.
Configure Thunderbird to block remote content and disable JavaScript in message display until patched.
Route web traffic through a filtering proxy that blocks known-malicious domains and enforces safe browsing lists.

bash

# Enterprise policy example: disable JavaScript in Thunderbird message display
# File: /etc/thunderbird/policies/policies.json
{
  "policies": {
    "DisableJavaScriptInMailMessages": true,
    "DisableAppUpdate": false
  }
}