CVE-2026-84121

CVE-2026-84121 is a use-after-free (CWE-416) in the DOM: Security component of Mozilla's engine that permits a sandbox escape, rated critical at CVSS 9.6 with the scope-change metric (S:C) reflecting the break out of the sandboxed content process. It is triggered when a user loads attacker-crafted content that causes the DOM security component to access freed memory, meaning user interaction is required. A successful attacker escapes the browser sandbox, and the high confidentiality/integrity/availability ratings indicate potential for high-impact compromise beyond the sandboxed context. Users running Firefox or Thunderbird prior to the fixed releases (Firefox 155; Firefox ESR 115.40, 140.15, or 153.2; Thunderbird 155, 140.15, or 153.2) are affected. No public proof-of-concept, KEV listing, or confirmed in-the-wild exploitation is known, and EPSS assigns a low 0.3% probability of exploitation within 30 days (25th percentile).

What to do: Upgrade Firefox to 155 or the latest fix on its ESR branch (115.40, 140.15, or 153.2), and Thunderbird to 155, 140.15, or 153.2 as applicable. Until patched, avoid loading untrusted web content and consider rendering Thunderbird email as plain text, and audit endpoint inventories for outdated Firefox/Thunderbird installs.