CVE-2026-84127 Overview
CVE-2026-84127 is an information disclosure vulnerability in the WebExtensions component of Mozilla Firefox for Android. The flaw allows a remote attacker to expose sensitive data from the browser when a user interacts with attacker-controlled content. Mozilla addressed the issue in Firefox 155 and documented it in security advisory MFSA-2026-82. The vulnerability is classified under CWE-200: Exposure of Sensitive Information to an Unauthorized Actor. No public exploit code is available, and the flaw is not listed in the CISA Known Exploited Vulnerabilities catalog.
Critical Impact
Successful exploitation exposes confidential browser data handled by WebExtensions on Android devices, undermining user privacy through drive-by web content.
Affected Products
- Mozilla Firefox for Android prior to version 155
- WebExtensions component on Android platform
- Mobile builds identified by CPE cpe:2.3:a:mozilla:firefox_mobile:*:*:*:*:*:android:*:*
Discovery Timeline
- 2026-09-01 - CVE-2026-84127 published to NVD
- 2026-09-03 - Last updated in NVD database
Technical Details for CVE-2026-84127
Vulnerability Analysis
The defect resides in the WebExtensions subsystem of Firefox for Android. WebExtensions is the browser API surface that hosts extension logic and mediates access to browser state, tabs, and page content. An information disclosure weakness in this component allows an attacker to obtain data that should remain isolated from untrusted web origins.
The issue is reachable over the network and requires user interaction, such as visiting a crafted page or interacting with malicious content. Exploitation does not require elevated privileges on the device. The confidentiality impact is limited, and integrity and availability are not affected.
Mozilla resolved the flaw in Firefox 155. Additional context is available in the Mozilla Security Advisory MFSA-2026-82 and the Mozilla Bug Report #1699444.
Root Cause
The root cause is improper isolation or handling of data within the WebExtensions component, allowing information to cross a trust boundary. Mozilla has not published exhaustive technical details for CVE-2026-84127 beyond the advisory. Refer to the vendor bug tracker for implementation specifics.
Attack Vector
An attacker hosts crafted web content and lures an Android Firefox user to interact with it. The interaction triggers the flawed WebExtensions code path, exposing browser-managed information to the attacker-controlled origin. No local access and no authentication are required.
No verified proof-of-concept code is publicly available. Refer to the vendor advisory and bug report for technical details.
Detection Methods for CVE-2026-84127
Indicators of Compromise
- Android devices running Firefox versions earlier than 155 in enterprise inventory scans
- Outbound HTTP requests from mobile browsers to untrusted domains carrying encoded browser state or extension data
- User reports of unexpected extension behavior after visiting external links
Detection Strategies
- Query mobile device management (MDM) inventories for the installed Firefox version and flag hosts below 155
- Inspect mobile web proxy logs for anomalous data exfiltration patterns originating from browser sessions
- Correlate phishing or malvertising alerts with Android user agents identifying vulnerable Firefox builds
Monitoring Recommendations
- Track Mozilla advisories, including MFSA-2026-82, for related follow-up disclosures
- Alert on Firefox for Android installations that fail to auto-update past version 155
- Monitor DNS and TLS SNI telemetry from mobile fleets for connections to newly registered domains delivering browser exploits
How to Mitigate CVE-2026-84127
Immediate Actions Required
- Upgrade Firefox for Android to version 155 or later on all managed and BYOD devices
- Enforce automatic browser updates through MDM policies for the Android estate
- Communicate to users the risk of interacting with untrusted links on mobile browsers until patching is confirmed
Patch Information
Mozilla fixed CVE-2026-84127 in Firefox 155. Deploy the update through the Google Play Store or managed distribution channels. Details are available in the Mozilla Security Advisory MFSA-2026-82 and the underlying Mozilla Bug Report #1699444.
Workarounds
- Restrict installation of unnecessary WebExtensions on Firefox for Android until devices are updated
- Route mobile browsing through corporate secure web gateways to filter known malicious content
- Educate users to avoid clicking untrusted links on Android devices running unpatched Firefox builds
# Configuration example
# Verify installed Firefox for Android version via adb
adb shell dumpsys package org.mozilla.firefox | grep versionName
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
