Buffer overflow in Mozilla products - CVE-2026-84145
Published: September 1, 2026
Vulnerability identifier: #VU146610
CSH Severity: High
CVSS v4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-84145
CWE-ID: CWE-119
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to cause a denial of service or execute arbitrary code.
The vulnerability exists due to memory corruption or another security-relevant defect in multiple unspecified components when processing web content. A remote attacker can convince the victim to visit a specially crafted website to cause a denial of service or execute arbitrary code.
The issue covers multiple internally found bugs.
Affected software
Mozilla Firefox
Firefox ESR
Firefox for Android
Firefox ESR
Firefox for Android
How to mitigate CVE-2026-84145
Install security update from vendor's website.
Mozilla Firefox - update to 155.0
Firefox for Android - update to 155.0
Firefox ESR - addressed in versions 115.40.0, 140.15.0, 153.2.0
Firefox for Android - update to 155.0
Firefox ESR - addressed in versions 115.40.0, 140.15.0, 153.2.0
External References
- https://www.mozilla.org/en-US/security/advisories/mfsa2026-83/
- https://www.mozilla.org/en-US/security/advisories/mfsa2026-82/
- https://www.mozilla.org/en-US/security/advisories/mfsa2026-84/
- https://www.mozilla.org/en-US/security/advisories/mfsa2026-85/
- https://bugzilla.mozilla.org/buglist.cgi?bug_id=2054640%2C2054650%2C2054652%2C2055693%2C2055705%2C2058051%2C2058652%2C2058660%2C2059027%2C2061220%2C2061242%2C2061285%2C2061300%2C2061316%2C2061397