CVE-2026-84130 Mozilla CVE debrief

Who should care

Users of Firefox, Firefox ESR, Thunderbird, and Thunderbird should apply patches to prevent potential information disclosure. Additionally, security teams and vulnerability management teams should review the official advisories and assess their exposure to the vulnerability. Operators and administrators of affected products should prioritize patching to minimize potential impact.

Technical summary

The vulnerability is caused by an information disclosure issue in the Graphics: WebGPU component of Firefox, Firefox ESR, Thunderbird, and Thunderbird. This issue was addressed by Mozilla in Firefox 155, Firefox ESR 153.2, Thunderbird 155, and Thunderbird 153.2. The vulnerability allows for potential information disclosure, which can be mitigated by applying the recommended patches. Affected products include Firefox, Firefox ESR, Thunderbird, and Thunderbird. Security teams should assess their exposure to the vulnerability and prioritize patching to minimize potential impact.

Defensive priority

High-priority patching recommended for affected products.

Recommended defensive actions

• Apply patches for Firefox 155, Firefox ESR 153.2, Thunderbird 155, and Thunderbird 153.2
• Inventory and update affected products
• Monitor for potential exploitation attempts
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the vulnerability. Vendor advisories are available for affected products. Evidence is limited to public sources and may not reflect the full scope or impact of the vulnerability. Defenders should verify affected product deployments and review official advisories for specific guidance. Additional information may be necessary to fully understand the vulnerability's impact.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.