CVE-2026-84145
HighCVSS 7.5Summary
Internally found bugs present in Firefox 154, Firefox ESR 153.1, Firefox ESR 140.14 and Firefox ESR 115.39. Some showed evidence of memory corruption or another security-relevant defect, potentially exploitable. Fixed in Firefox 155, Firefox ESR 115.40, Firefox ESR 140.15, and Firefox ESR 153.2.
Risk Assessment
Potential risk of remote code execution or other attacks on browser users, potentially leading to data confidentiality breaches.
Recommendation
Update Firefox to version 155 or the appropriate ESR version as indicated.
Other vulnerabilities in Firefox
See all- CVE-2026-84144Unknown
Internally found bugs present in Firefox 154 and Firefox ESR 153.1. Some of these bugs showed evidence of memory corruption or another security-relevant defect and we presume that with enough effort some of these could have been exploited. This vulnerability was fixed in Firefox 155 and Firefox ESR 153.2.
- CVE-2026-84143Unknown
Internally found bugs present in Firefox 154, Firefox ESR 153.1 and Firefox ESR 140.14. Some of these bugs showed evidence of memory corruption or another security-relevant defect and we presume that with enough effort some of these could have been exploited. This vulnerability was fixed in Firefox 155, Firefox ESR 140.15, and Firefox ESR 153.2.
- CVE-2026-84142Unknown
Internally found bugs present in Firefox 154. Some of these bugs showed evidence of memory corruption or another security-relevant defect and we presume that with enough effort some of these could have been exploited. This vulnerability was fixed in Firefox 155.
- CVE-2026-84141Unknown
Integer overflow in the Graphics: ImageLib component. This vulnerability was fixed in Firefox 155 and Firefox ESR 153.2.
- CVE-2026-84140Unknown
Site isolation issue in the DOM: Navigation component. This vulnerability was fixed in Firefox 155 and Firefox ESR 153.2.
- CVE-2026-84139Unknown
Clickjacking issue in the DOM: Events component. This vulnerability was fixed in Firefox 155 and Firefox ESR 153.2.
- CVE-2026-84138Unknown
Denial-of-service in the PDF Viewer component. This vulnerability was fixed in Firefox 155.
- CVE-2026-84137Unknown
Spoofing vulnerability in the DOM: Core & HTML component of Firefox. It was fixed in Firefox 155 and Firefox ESR 153.2.
- CVE-2026-84136Unknown
Other issue in the DOM: Navigation component of Firefox. It was fixed in Firefox 155 and Firefox ESR 153.2.
- CVE-2026-84134Unknown
Other issue in the Profile Backup component of Firefox. It was fixed in Firefox 155 and Firefox ESR 153.2.
Original NVD description (English source)
Internally found bugs present in Firefox 154, Firefox ESR 153.1, Firefox ESR 140.14 and Firefox ESR 115.39. Some of these bugs showed evidence of memory corruption or another security-relevant defect and we presume that with enough effort some of these could have been exploited. This vulnerability was fixed in Firefox 155, Firefox ESR 115.40, Firefox ESR 140.15, and Firefox ESR 153.2.