CVE-2026-84128: Mozilla Firefox Privilege Escalation Flaw

CVE-2026-84128 Overview

CVE-2026-84128 is a privilege escalation vulnerability in the WebDriver BiDi (Bidirectional) component of Mozilla Firefox and Mozilla Thunderbird. The flaw allows a remote attacker to escalate privileges within the browser process when a user is convinced to interact with attacker-controlled content. Mozilla addressed the issue in Firefox 155 and Thunderbird 155. The vulnerability is categorized under CWE-284: Improper Access Control.

Critical Impact
Successful exploitation lets an attacker break out of the WebDriver BiDi trust boundary and gain elevated privileges within the browser, leading to high-impact compromise of confidentiality, integrity, and availability.

Affected Products

Mozilla Firefox versions prior to 155
Mozilla Thunderbird versions prior to 155
Deployments exposing or enabling the WebDriver BiDi automation interface

Discovery Timeline

2026-09-01 - CVE-2026-84128 published to NVD
2026-09-03 - Last updated in NVD database

Technical Details for CVE-2026-84128

Vulnerability Analysis

The vulnerability resides in the WebDriver BiDi component, which implements the bidirectional protocol used to automate and instrument Firefox-based applications. WebDriver BiDi exposes privileged automation primitives that must be strictly isolated from untrusted web content. Improper access control in this component allows content operating at a lower privilege level to reach functionality intended for the automation layer. An attacker who convinces a user to load crafted content can leverage this gap to execute actions at elevated privileges inside the browser. Because Thunderbird reuses Gecko rendering internals, the same defect impacts the mail client.

Root Cause

The root cause is improper access control (CWE-284) within the WebDriver BiDi command dispatch and capability boundary. Privileged operations exposed by the BiDi interface are not sufficiently gated from untrusted contexts. Mozilla details the fix in Mozilla Bug Report #2044280.

Attack Vector

Exploitation occurs over the network and requires user interaction, such as visiting a malicious page or opening crafted email content in Thunderbird. No prior authentication to the target is needed. Once triggered, the attacker gains privileges beyond the standard web content sandbox, enabling further payload delivery, data theft, or persistence attempts inside the browser process.

No verified proof-of-concept code is publicly available at this time. Refer to Mozilla Security Advisory MFSA-2026-82 and Mozilla Security Advisory MFSA-2026-86 for vendor technical detail.

Detection Methods for CVE-2026-84128

Indicators of Compromise

Unexpected Firefox or Thunderbird processes launching child processes such as shells, scripting hosts, or system utilities.
Outbound connections from firefox.exe or thunderbird.exe to unfamiliar domains shortly after a user opened untrusted content.
Presence of unexpected WebDriver BiDi sessions or listening automation ports on end-user endpoints.

Detection Strategies

Inventory installed Firefox and Thunderbird versions and flag any instance below version 155.
Monitor for anomalous use of WebDriver BiDi command traffic on hosts not designated for browser automation.
Correlate browser child-process creation events with recent web navigations or opened email messages.

Monitoring Recommendations

Enable process creation and network connection telemetry from browser and mail client binaries.
Alert on browser-spawned interpreters (powershell.exe, cmd.exe, wscript.exe, bash) as high-fidelity signals.
Track patch compliance dashboards for Mozilla products across managed endpoints.

How to Mitigate CVE-2026-84128

Immediate Actions Required

Upgrade Firefox to version 155 or later on all endpoints, including ESR channels where a fixed build is offered.
Upgrade Thunderbird to version 155 or later across all mail-enabled endpoints.
Restart affected applications after patching to ensure the vulnerable code is unloaded from memory.
Audit endpoints for unauthorized WebDriver BiDi usage or automation profiles.

Patch Information

Mozilla released fixes in Firefox 155 and Thunderbird 155. Details and package links are available in Mozilla Security Advisory MFSA-2026-82 and Mozilla Security Advisory MFSA-2026-86.

Workarounds

Where immediate patching is not possible, disable WebDriver BiDi automation on production endpoints by ensuring remote.active-protocols does not enable BiDi.
Restrict users from loading untrusted content and enforce email rendering in plain text where feasible.
Apply enterprise policies to block browser-launched interpreters via application control.

bash

# Configuration example: enforce Firefox update channel via policies.json
# Location (Linux): /etc/firefox/policies/policies.json
{
  "policies": {
    "DisableAppUpdate": false,
    "AppAutoUpdate": true,
    "DisabledFeatures": ["webdriver"]
  }
}