CVE-2026-84143: Mozilla Firefox Use-After-Free Vulnerability

CVE-2026-84143 Overview

CVE-2026-84143 is a memory corruption vulnerability affecting Mozilla Firefox and Thunderbird. Mozilla engineers found multiple internal bugs in Thunderbird 154, Thunderbird ESR 153.1, and Thunderbird ESR 140.14 that showed evidence of memory corruption or other security-relevant defects. Mozilla presumes that some of these defects could have been exploited with sufficient effort. The issue is classified under [CWE-119], improper restriction of operations within the bounds of a memory buffer. Mozilla fixed the vulnerability in Firefox 155, Firefox ESR 140.15, Firefox ESR 153.2, Thunderbird 155, Thunderbird 140.15, and Thunderbird 153.2.

Critical Impact
Memory corruption in Firefox and Thunderbird can lead to arbitrary code execution in the context of the browser or mail client through a network-reachable attack vector requiring no user interaction beyond content rendering.

Affected Products

Mozilla Thunderbird 154, Thunderbird ESR 153.1, and Thunderbird ESR 140.14
Mozilla Firefox versions prior to 155
Mozilla Firefox ESR versions prior to 140.15 and prior to 153.2

Discovery Timeline

2026-09-01 - CVE-2026-84143 published to NVD
2026-09-03 - Last updated in NVD database

Technical Details for CVE-2026-84143

Vulnerability Analysis

CVE-2026-84143 aggregates a set of internally discovered bugs in Mozilla Firefox and Thunderbird that exhibited memory corruption or other security-relevant defects. Mozilla's advisory language, consistent with prior end-of-cycle rollup bulletins, indicates the defects were caught by internal fuzzing, static analysis, and code review during release testing. The class of defect maps to [CWE-119], covering out-of-bounds reads and writes, use-after-free, and related buffer boundary failures in the Gecko rendering engine and shared code paths used by both products.

Root Cause

The root cause spans multiple bugs in memory-handling routines within the shared codebase used by Firefox and Thunderbird. Mozilla references two Bugzilla clusters and a specific bug (#2057108) covering the affected components. Because Thunderbird reuses Gecko for HTML message rendering, defects introduced in Firefox code paths propagate directly to the mail client.

Attack Vector

Exploitation requires an attacker to deliver malicious web content or a crafted HTML email that triggers the vulnerable code path. In Firefox, a user visiting an attacker-controlled page is sufficient. In Thunderbird, rendering a crafted message can trigger the defect, though scripting in mail is disabled by default which reduces exposure for some sub-issues. Successful exploitation could allow arbitrary code execution within the process rendering the content.

No public proof-of-concept code is available. Mozilla has not disclosed exploit details in the referenced advisories: MFSA-2026-82, MFSA-2026-84, MFSA-2026-85, MFSA-2026-86, MFSA-2026-87, and MFSA-2026-88.

Detection Methods for CVE-2026-84143

Indicators of Compromise

Unexpected child processes spawned from firefox.exe, thunderbird.exe, or their macOS and Linux equivalents
Crashes in Firefox or Thunderbird content processes correlated with rendering specific URLs or messages
Outbound network connections from browser or mail client processes to previously unseen infrastructure following content rendering

Detection Strategies

Inventory installed Firefox and Thunderbird versions across managed endpoints and flag any running vulnerable builds identified in the Mozilla advisories
Monitor for anomalous process lineage where Firefox or Thunderbird spawns shells, scripting hosts, or LOLBins such as powershell.exe, cmd.exe, or bash
Correlate browser and mail client crash telemetry with URL and sender metadata to identify targeted exploitation attempts

Monitoring Recommendations

Enable process execution logging and command-line auditing on endpoints running Firefox or Thunderbird
Forward browser and mail client telemetry to a centralized SIEM or data lake for retrospective hunting against future indicators
Track patch compliance metrics for Firefox 155, Firefox ESR 140.15, Firefox ESR 153.2, and the corresponding Thunderbird releases

How to Mitigate CVE-2026-84143

Immediate Actions Required

Upgrade Firefox to version 155 or later, Firefox ESR to 140.15 or 153.2, and Thunderbird to 155, 140.15, or 153.2
Prioritize patching on endpoints handling untrusted content such as workstations used for web browsing and external email
Verify enterprise auto-update policies are enabled and functioning for both Firefox and Thunderbird deployments

Patch Information

Mozilla addressed CVE-2026-84143 in Firefox 155, Firefox ESR 140.15, Firefox ESR 153.2, Thunderbird 155, Thunderbird 140.15, and Thunderbird 153.2. Patch details and referenced Bugzilla clusters are available in MFSA-2026-82 through MFSA-2026-88.

Workarounds

Disable JavaScript in Thunderbird message display if not already disabled, reducing exposure for script-triggered defects
Restrict access to untrusted websites via network filtering or browser isolation on high-risk hosts until patches are deployed
Configure email gateways to strip or sanitize active HTML content from inbound messages where operationally feasible

bash

# Configuration example: verify installed versions on Linux endpoints
firefox --version
thunderbird --version

# Force update on managed Windows endpoints via policy
reg add "HKLM\SOFTWARE\Policies\Mozilla\Firefox" /v DisableAppUpdate /t REG_DWORD /d 0 /f