CVE-2026-84143 is a set of internally found memory safety bugs in Firefox, Firefox ESR and Thunderbird, scored 9.8 (critical) by NVD. Fixed releases are Firefox 155, Firefox ESR 153.2, Firefox ESR 140.15, Thunderbird 155, Thunderbird 153.2 and Thunderbird 140.15. The sections below cover affected versions, how to check your exposure and what to do first.
What's affected
The record names bugs present in Thunderbird 154, Thunderbird ESR 153.1 and Thunderbird ESR 140.14. Mozilla's Firefox advisory lists the matching Firefox builds: Firefox 154, Firefox ESR 153.1 and Firefox ESR 140.14.
Fixed versions, per the record: Firefox 155, Firefox ESR 140.15, Firefox ESR 153.2, Thunderbird 155, Thunderbird 140.15 and Thunderbird 153.2. The weaknesses are listed as CWE-119 and CWE-200. Mozilla says some of the bugs showed evidence of memory corruption. It does not report exploitation, and the record is not in the CISA KEV catalog.
How to check if you're exposed
Check the version in the About dialog of each application, or from a terminal.
firefox --version
thunderbird --version
Compare the result with your channel. On the ESR 140 line you need 140.15 or later. On the ESR 153 line you need 153.2 or later. On the rapid release line you need 155 or later. Distribution packages may backport fixes, so confirm against the distribution advisory.
What to do now
- Identify which channel each host runs: rapid release, ESR 140 or ESR 153.
- Update Firefox and Thunderbird to the fixed version for that channel.
- Restart the applications after updating.
- Check shared images, terminal servers and kiosk builds that pin an ESR version.
- Keep an inventory of browsers and mail clients so you can answer this question in minutes next time.
Why it matters
Mozilla fuzzes its own code and reports what it finds in bulk. The advisory groups many bugs, some of them memory corruption, and the CVE inherits a single worst case score. Memory safety bugs in a browser engine matter because the engine parses untrusted content all day.
The ESR lines are the ones enterprises tend to leave behind. If you pin a version for compatibility, put the ESR point release on your patch calendar.
Quick check
Does Thunderbird need the update if scripting is off for mail?
Mozilla says similar flaws generally cannot be reached through email because scripting is off when reading mail, but they can matter in browser like contexts. Update anyway, since the release is a normal one.
Sources
- Mozilla advisory MFSA 2026-84 (Firefox ESR 140.15)
- Mozilla advisory MFSA 2026-82 (Firefox 155)
- NVD record for CVE-2026-84143
Last reviewed: 19 October 2026.
