CVE-2026-84132

CVE-2026-84132 is an information-disclosure vulnerability (CWE-200) in the Networking: HTTP component of Mozilla Firefox and Mozilla Thunderbird. Because the flaw sits in the HTTP networking stack, it is triggered remotely through the client's handling of network traffic, and its CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) indicates it is exploitable over a network with low attack complexity and without privileges or user interaction. A successful attacker gains access to sensitive information processed by the affected client (high confidentiality impact), with no impact on integrity or availability. Users running Firefox before 155, Firefox ESR before 153.2, Thunderbird before 155, or Thunderbird before 153.2 are affected. There is currently no evidence of exploitation: no public proof-of-concept is known, the flaw is not in the CISA KEV catalog, and EPSS assigns a low 0.3% probability (17th percentile) of exploitation within the next 30 days.

What to do: Upgrade all managed endpoints to Firefox 155 or Firefox ESR 153.2 (or later) and to Thunderbird 155 or Thunderbird 153.2 (or later), and verify installed versions through your device-management or EDR inventory. No specific workaround is documented in the available data, so updating is the primary mitigation; keep automatic updates enabled. Given the confidentiality-only impact and the absence of known exploitation, patching on your standard cadence is reasonable, with priority for users and hosts that handle sensitive information.