CVE-2026-84128 Mozilla CVE debrief

Who should care

Users of Mozilla Firefox and Thunderbird, particularly those using WebDriver BiDi, should prioritize patching to version 155 or later to mitigate the privilege escalation vulnerability. This includes operators, security teams, and vulnerability management teams responsible for maintaining up-to-date software deployments.

Technical summary

The WebDriver BiDi component in Firefox and Thunderbird is vulnerable to privilege escalation. This issue was patched in Firefox 155 and Thunderbird 155. Users of affected versions should update to the latest version to mitigate the vulnerability. The vulnerability has a CVSS score of 8.8 and is considered HIGH severity. Affected users, particularly those using WebDriver BiDi, should prioritize patching to version 155 or later. Evidence is limited to CVE and NVD sources, and defenders should verify patch deployment and WebDriver BiDi usage. Mozilla products using WebDriver BiDi may be vulnerable to privilege escalation attacks; prioritize patching Firefox and Thunderbird to version 155. Users of Mozilla Firefox and Thunderbird, particularly those using WebDriver BiDi, should prioritize patching to version 155 or later to mitigate the privilege escalation vulnerability.

Defensive priority

Mozilla products using WebDriver BiDi may be vulnerable to privilege escalation attacks; prioritize patching Firefox and Thunderbird to version 155.

Recommended defensive actions

• Patch Firefox to version 155 or later
• Patch Thunderbird to version 155 or later
• Review and update inventory of Mozilla products using WebDriver BiDi
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review compensating controls for exposed systems while remediation is scheduled and verified.

Evidence notes

The CVE record indicates a HIGH severity vulnerability with a CVSS score of 8.8. The WebDriver BiDi component in Firefox and Thunderbird is vulnerable to privilege escalation. The issue was fixed in Firefox 155 and Thunderbird 155. Evidence is limited to CVE and NVD sources, and defenders should verify patch deployment and WebDriver BiDi usage.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.