CVE-2026-84135 is an unspecified issue in Firefox Focus for Android that NVD scores 9.8 while Mozilla rates its impact as low. Mozilla fixed it in Firefox 155. Update Focus through your app store, and read both ratings before deciding how urgent it is for your devices.
What's affected
The record lists Firefox Focus for Android and says the issue was fixed in Firefox 155. Mozilla's advisory MFSA 2026-82 announced on 1 September 2026 lists it as CVE-2026-84135, described as an other issue in Firefox Focus for Android, with an impact of low and a link to Bug 2046661.
Mozilla gives no more detail on the bug. The two ratings disagree sharply, so be clear about which you use. NVD's 9.8 comes from a generic vector. Mozilla's low reflects its own assessment of the real effect.
How to check if you're exposed
On an Android device, open the app store listing for Firefox Focus and check the installed version, or open Settings, then Apps, then Focus, and read the version. Compare it to release 155 or later.
If you manage devices, check your mobile device management inventory for the Focus package and its version.
What to do now
- Update Firefox Focus on Android to version 155 or later.
- If you manage devices, push the update through your mobile device management tool.
- Review Mozilla's advisory MFSA 2026-82 for the other Firefox 155 fixes.
- Do not rely on the 9.8 score alone to rank this issue, and note Mozilla's low rating in your tracking.
- Turn on automatic app updates for browsers.
Why it matters
The record lists CWE-20, improper input validation, and CWE-200, exposure of sensitive information. Those labels are broad, and the vendor does not describe the specific flaw.
This is a good example of why a score and a vendor rating can differ. NVD scored a vector that assumes the worst case. Mozilla looked at the actual bug. Neither number tells you whether your devices are at risk without knowing the bug. The record is not listed in CISA's KEV catalog. Updating is cheap, so do it.
Quick check
Which rating should I trust, 9.8 or low?
Use both. The score is a standard worst case template, and the vendor rating is its judgment of the real bug. The fix is a routine update either way.
Sources
Last reviewed: 19 October 2026.
