CVE-2026-84144: Mozilla Firefox Use-After-Free Vulnerability

CVE-2026-84144 Overview

CVE-2026-84144 covers a set of internally discovered bugs affecting Mozilla Thunderbird 154 and Thunderbird ESR 153.1. Several of the reported defects exhibited evidence of memory corruption or other security-relevant behavior. Mozilla assesses that a sufficiently motivated attacker could have exploited some of these issues. The flaws also impact Mozilla Firefox releases sharing the same underlying code. Fixes shipped in Firefox 155, Firefox ESR 153.2, Thunderbird 155, and Thunderbird 153.2. The vulnerability class is tracked under CWE-119 (improper restriction of operations within the bounds of a memory buffer).

Critical Impact
Successful exploitation could enable arbitrary code execution within the browser or mail client process, leading to full compromise of user data and session integrity.

Affected Products

Mozilla Thunderbird 154 and Thunderbird ESR 153.1
Mozilla Firefox prior to 155 and Firefox ESR prior to 153.2
All platforms distributing the affected Mozilla builds (Windows, macOS, Linux)

Discovery Timeline

2026-09-01 - CVE-2026-84144 published to NVD
2026-09-03 - Last updated in NVD database

Technical Details for CVE-2026-84144

Vulnerability Analysis

CVE-2026-84144 aggregates multiple defects found through Mozilla's internal fuzzing and code-audit programs. The advisory ties the issues to memory-safety weaknesses categorized under [CWE-119], which covers buffer handling errors such as out-of-bounds reads, out-of-bounds writes, and use-after-free conditions. Mozilla did not publish per-bug root-cause analyses because the issues were not observed under active exploitation. However, the vendor explicitly warns that some defects showed indicators consistent with exploitable memory corruption.

The network attack vector combined with a user-interaction requirement points to content-driven exploitation. A victim would need to render attacker-controlled web content in Firefox or process a crafted message or embedded resource in Thunderbird. High attack complexity indicates that reliable exploitation requires bypassing mitigations such as ASLR and sandboxing.

Root Cause

The underlying weakness stems from improper bounds enforcement inside Gecko and related components shared between Firefox and Thunderbird. Bug references listed on Bugzilla span parsing, rendering, and runtime allocation paths. Refer to the aggregated Mozilla Bug List for individual defect metadata.

Attack Vector

Exploitation requires the victim to load malicious content. In Firefox, this typically means visiting a crafted web page. In Thunderbird, a specially crafted email that triggers HTML rendering or remote resource loading could reach the vulnerable code paths. Because user interaction is required and attack complexity is high, mass exploitation is unlikely; targeted delivery is the more realistic scenario.

No public proof-of-concept exploit is available at this time. Consult the Mozilla Security Advisory MFSA-2026-82 and related MFSA-2026-85, 86, and 88 bulletins for defect-level context.

Detection Methods for CVE-2026-84144

Indicators of Compromise

Unexpected crashes of firefox.exe or thunderbird.exe with access-violation exceptions, especially during page render or message preview.
Creation of new child processes from the browser or mail client that do not match legitimate Mozilla update or plugin activity.
Outbound network connections from Firefox or Thunderbird processes to unfamiliar hosts immediately after opening a message or URL.

Detection Strategies

Monitor crash telemetry from endpoints and correlate repeated Mozilla process crashes with the affected build versions.
Alert on suspicious process lineage where firefox.exe or thunderbird.exe spawns shell interpreters, powershell.exe, or cmd.exe.
Inspect email gateways for messages containing crafted HTML, malformed MIME parts, or embedded scripts targeting mail clients.

Monitoring Recommendations

Inventory installed Firefox and Thunderbird versions across the fleet and flag hosts running builds prior to the fixed releases.
Ingest browser and mail client crash logs into a centralized data lake for anomaly detection and version-based cohort analysis.
Track EDR telemetry for memory-corruption indicators such as heap sprays, unusual JIT allocations, or unexpected module loads in Mozilla processes.

How to Mitigate CVE-2026-84144

Immediate Actions Required

Update Firefox to version 155 or Firefox ESR 153.2 on all endpoints.
Update Thunderbird to version 155 or Thunderbird 153.2 for enterprise deployments still on the ESR channel.
Restart affected applications after patching to ensure the vulnerable code is unloaded from memory.

Patch Information

Mozilla addressed the defects in Firefox 155, Firefox ESR 153.2, Thunderbird 155, and Thunderbird 153.2. Enterprise administrators should reference Mozilla Security Advisory MFSA-2026-85, MFSA-2026-86, and MFSA-2026-88 for release-channel guidance and download packages.

Workarounds

Disable HTML rendering in Thunderbird and configure the client to display messages as plain text until patching is complete.
Block remote content loading in mail messages via enterprise policy to reduce exposure to email-delivered exploit payloads.
Restrict browsing to trusted sites through DNS filtering or proxy allow-lists while patch deployment is in progress.

bash

# Configuration example: enforce Thunderbird plain-text rendering via policies.json
{
  "policies": {
    "DisplayMenuBar": "default-on",
    "Preferences": {
      "mailnews.display.prefer_plaintext": { "Value": true, "Status": "locked" },
      "mailnews.message_display.disable_remote_image": { "Value": true, "Status": "locked" }
    }
  }
}