CVE-2026-84121

Analyzed Analyzed - Analysis Complete

DOM Use-After-Free Vulnerability in Firefox

Publication date: 2026-09-01

Last updated on: 2026-09-02

Assigner: Mozilla Corporation

Description

Sandbox escape due to use-after-free in the DOM: Security component. This vulnerability was fixed in Firefox 155, Firefox ESR 115.40, Firefox ESR 140.15, Firefox ESR 153.2, Thunderbird 155, Thunderbird 140.15, and Thunderbird 153.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-01

Last Modified

2026-09-02

Generated

2026-09-21

AI Q&A

2026-09-01

EPSS Evaluated

2026-09-20

NVD

CVE-2026-84121

EUVD

EUVD-2026-69066

Affected Vendors & Products

Vendor	Product	Version / Range
mozilla	firefox	From 154.0.0 (inc) to 155.0.0 (exc)
mozilla	thunderbird	From 154.0 (inc) to 155.0 (exc)
mozilla	firefox	From 141.0.0 (inc) to 153.2.0 (exc)
mozilla	thunderbird	to 140.15.0 (exc)
mozilla	thunderbird	From 141.0 (inc) to 153.2.0 (exc)
mozilla	firefox	to 115.40.0 (exc)
mozilla	firefox	From 116.0 (inc) to 140.15.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-416	The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

Attack-Flow Graph

Executive Summary

CVE-2026-84121 is a sandbox escape vulnerability caused by a use-after-free flaw in the DOM: Security component of Firefox. This means an attacker could exploit memory corruption to bypass security restrictions and potentially execute arbitrary code on affected systems.

Detection Guidance

Check Firefox version with 'firefox --version' or 'about:support' in Firefox. If using ESR, verify version is 115.40, 140.15, or 153.2 or higher. Monitor for unusual processes or network activity indicating sandbox escape attempts.

Impact Analysis

This vulnerability allows attackers to bypass security restrictions, potentially leading to unauthorized code execution. If exploited, it could compromise sensitive data, install malware, or give attackers control over the affected system.

Compliance Impact

The provided CVE data does not specify direct impacts on compliance with standards like GDPR or HIPAA. However, sandbox escape vulnerabilities can potentially lead to unauthorized data access or execution of arbitrary code, which may violate data protection requirements under GDPR (e.g., unauthorized processing) or HIPAA (e.g., unauthorized access to protected health information).

Mitigation Strategies

Update Firefox to version 155 or higher, or Firefox ESR to 115.40, 140.15, or 153.2 or higher immediately. Disable unnecessary Firefox features and restrict user permissions until patched.

Hi! I’m here to help you understand CVE-2026-84121. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70