This report was translated by AI; nobody has reviewed the translation yet. Original language: Czech.
[TLP:CLEAR] Mozilla fixes over 30 vulnerabilities
Mozilla fixes over 30 vulnerabilities in various products. The most severe vulnerabilities are listed below. Individual products and their fixed versions: Firefox - 155 [1] Firefox ESR - 115.40, 140.15, 153.2 [2][3][4] Firefox for iOS - 155.0 [5] Thunderbird - 140.15, 153.2, 155 [6][7][8]
An unauthenticated remote attacker can escape the browser sandbox due to a use-after-free vulnerability in the DOM: Navigation component [1][2][3][4][6][7][8][9].
The vulnerability is present in products:
- Firefox; <155
- Firefox ESR; >=115, <115.40; >=140, <140.15; >=153, <153.2
- Thunderbird; <155; >=140, <140.15; >=153, <153.2
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
More information:
- CVE-2026-84119 at cve.org, NVD
- CWE-416: Use After Free at cwe.mitre.org
The vulnerability was publicly disclosed 1. 9. 2026.
An unauthenticated remote attacker can escape the browser sandbox due to a use-after-free vulnerability in the DOM: Security component [1][2][3][4][6][7][8][10].
The vulnerability is present in products:
- Firefox; <155
- Firefox ESR; >=115, <115.40; >=140, <140.15; >=153, <153.2
- Thunderbird; <155; >=140, <140.15; >=153, <153.2
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
More information:
- CVE-2026-84121 at cve.org, NVD
- CWE-416: Use After Free at cwe.mitre.org
The vulnerability was publicly disclosed 1. 9. 2026.
An unauthenticated remote attacker can escape the application sandbox due to insufficient enforcement of security mechanisms in the Remote Settings Client component [2][3][4][6][7][11].
The vulnerability is present in products:
- Firefox ESR; >=115, <115.40; >=140, <140.15; >=153, <153.2
- Thunderbird; >=140, <140.15; >=153, <153.2
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
More information:
- CVE-2026-75874 at cve.org, NVD
- CWE-693: Protection Mechanism Failure at cwe.mitre.org
An unauthenticated remote attacker can elevate their privileges due to a use-after-free vulnerability in the Graphics: WebGPU component [1][4][8][12].
The vulnerability is present in products:
- Firefox; <155
- Firefox ESR; >=153, <153.2
- Thunderbird; <155
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
More information:
- CVE-2026-84123 at cve.org, NVD
- CWE-416: Use After Free at cwe.mitre.org
The vulnerability was publicly disclosed 1. 9. 2026.
An unauthenticated remote attacker can elevate their privileges due to insufficient access control in Firefox for Android [1][13].
The vulnerability is present in product:
- Firefox; <155
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
More information:
- CVE-2026-84117 at cve.org, NVD
- CWE-284: Improper Access Control at cwe.mitre.org
The vulnerability was publicly disclosed 1. 9. 2026.
Links
- [1] https://www.mozilla.org/en-US/security/advisories/mfsa2026-82/
- [2] https://www.mozilla.org/en-US/security/advisories/mfsa2026-83/
- [3] https://www.mozilla.org/en-US/security/advisories/mfsa2026-84/
- [4] https://www.mozilla.org/en-US/security/advisories/mfsa2026-85/
- [5] https://www.mozilla.org/en-US/security/advisories/mfsa2026-81/
- [6] https://www.mozilla.org/en-US/security/advisories/mfsa2026-87/
- [7] https://www.mozilla.org/en-US/security/advisories/mfsa2026-88/
- [8] https://www.mozilla.org/en-US/security/advisories/mfsa2026-86/
- [9] https://nvd.nist.gov/vuln/detail/cve-2026-84119
- [10] https://nvd.nist.gov/vuln/detail/cve-2026-84121
- [11] https://nvd.nist.gov/vuln/detail/cve-2026-75874
- [12] https://nvd.nist.gov/vuln/detail/cve-2026-84123
- [13] https://nvd.nist.gov/vuln/detail/cve-2026-84117
By CESNET, z.s.p.o. Michaela Jarošová on 2. 9. 2026.