CVE-2026-84142 covers internally found memory safety bugs in Firefox 154 and Thunderbird 154. NVD scores it 9.8 (critical), while Mozilla rates the underlying bugs moderate. The fix shipped in Firefox 155 and Thunderbird 155, so updating both applications is the action. The sections below cover affected versions, how to check your exposure and what to do first.
What's affected
Mozilla describes bugs present in Firefox 154 and Thunderbird 154, found by its own fuzzing team. Mozilla says some of them showed evidence of memory corruption and that it presumes some could be exploited with enough effort. The record lists the weakness classes CWE-119 and CWE-200 and the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
The fix is in Firefox 155 and Thunderbird 155, announced on 1 September 2026. The record is not in the CISA Known Exploited Vulnerabilities catalog, and Mozilla does not report attacks for it.
How to check if you're exposed
In Firefox, open the menu, choose Help, then About Firefox, and read the version number. In Thunderbird, open Help, then About Thunderbird. On Linux you can also check from a terminal.
firefox --version
thunderbird --version
Anything below 155 on the standard release channel is affected. Packaged builds from a Linux distribution may carry the fix under a different version string, so check your distribution advisory.
What to do now
- Update Firefox to 155 or later on every desktop and server image that ships it.
- Update Thunderbird to 155 or later.
- Check kiosk, VDI and golden image builds, which often lag behind user machines.
- Restart the applications after the update so the new binary is the one running.
- Add both products to your software inventory so the next advisory maps to real hosts quickly.
Why it matters
These are classic memory safety defects, the kind that fuzzing finds before attackers do. Mozilla bundles many low and moderate bugs into one advisory, and the CVE record then inherits a worst case score that does not describe any single bug. That is why NVD shows 9.8 while Mozilla calls the impact moderate.
The practical lesson is to treat browser updates as routine, not as an incident. Browsers fix bugs of this class every few weeks, and the cheapest defence is a short patch cycle.
Quick check
Why is the score 9.8 if Mozilla says moderate?
NVD scored the record with a network vector and no privileges. Mozilla rated the internal bugs themselves as moderate. Read both and patch either way.
Sources
- Mozilla advisory MFSA 2026-82 (Firefox 155)
- Mozilla advisory MFSA 2026-86 (Thunderbird 155)
- NVD record for CVE-2026-84142
Last reviewed: 19 October 2026.
