CVE-2026-84131

CVE-2026-84131 is a privilege escalation flaw caused by an invalid pointer in the Graphics component of Mozilla Firefox and Thunderbird. It is triggered when the affected application processes crafted graphics content, most plausibly malicious web content rendered after user interaction, consistent with the CVSS user-interaction requirement. An attacker who successfully exploits it can escalate privileges, potentially gaining elevated access within the browser or mail client that could aid further attacks such as sandbox escapes when chained with other flaws. Anyone running affected versions of Firefox or Thunderbird prior to the fixed releases is exposed. As of now there are no known public proofs of concept, no CISA KEV listing, and no confirmed in-the-wild exploitation, with EPSS estimating only a 0.3% chance of exploitation within 30 days.

What to do: Upgrade Firefox to 155, Firefox ESR to 115.40, 140.15, or 153.2, and Thunderbird to 155, 140.15, or 153.2 as applicable. Until patched, avoid loading untrusted web content or email messages in affected builds, and verify deployed versions across managed endpoints. Monitor Mozilla security advisories and this dashboard for any emergence of public exploits or in-the-wild exploitation.