CVE-2026-84121
CriticalCVSS 9.6Summary
Sandbox escape vulnerability due to use-after-free in the DOM: Security component. Fixed in Firefox 155, Firefox ESR 115.40, 140.15, and 153.2.
Risk Assessment
An attacker could exploit this to escape the browser sandbox, potentially executing malicious code outside browser restrictions and compromising system security.
Recommendation
Immediately update Firefox to version 155 or later, or to the specified patched ESR versions.
Other vulnerabilities in Firefox
See all- CVE-2026-84145High
Internally found bugs present in Firefox 154, Firefox ESR 153.1, Firefox ESR 140.14 and Firefox ESR 115.39. Some showed evidence of memory corruption or another security-relevant defect, potentially exploitable. Fixed in Firefox 155, Firefox ESR 115.40, Firefox ESR 140.15, and Firefox ESR 153.2.
- CVE-2026-84144Unknown
Internally found bugs present in Firefox 154 and Firefox ESR 153.1. Some of these bugs showed evidence of memory corruption or another security-relevant defect and we presume that with enough effort some of these could have been exploited. This vulnerability was fixed in Firefox 155 and Firefox ESR 153.2.
- CVE-2026-84143Unknown
Internally found bugs present in Firefox 154, Firefox ESR 153.1 and Firefox ESR 140.14. Some of these bugs showed evidence of memory corruption or another security-relevant defect and we presume that with enough effort some of these could have been exploited. This vulnerability was fixed in Firefox 155, Firefox ESR 140.15, and Firefox ESR 153.2.
- CVE-2026-84142Unknown
Internally found bugs present in Firefox 154. Some of these bugs showed evidence of memory corruption or another security-relevant defect and we presume that with enough effort some of these could have been exploited. This vulnerability was fixed in Firefox 155.
- CVE-2026-84141Unknown
Integer overflow in the Graphics: ImageLib component. This vulnerability was fixed in Firefox 155 and Firefox ESR 153.2.
- CVE-2026-84140Unknown
Site isolation issue in the DOM: Navigation component. This vulnerability was fixed in Firefox 155 and Firefox ESR 153.2.
- CVE-2026-84139Unknown
Clickjacking issue in the DOM: Events component. This vulnerability was fixed in Firefox 155 and Firefox ESR 153.2.
- CVE-2026-84138Unknown
Denial-of-service in the PDF Viewer component. This vulnerability was fixed in Firefox 155.
- CVE-2026-84137Unknown
Spoofing vulnerability in the DOM: Core & HTML component of Firefox. It was fixed in Firefox 155 and Firefox ESR 153.2.
- CVE-2026-84136Unknown
Other issue in the DOM: Navigation component of Firefox. It was fixed in Firefox 155 and Firefox ESR 153.2.
Original NVD description (English source)
Sandbox escape due to use-after-free in the DOM: Security component. This vulnerability was fixed in Firefox 155, Firefox ESR 115.40, Firefox ESR 140.15, and Firefox ESR 153.2.