CVE-2026-84143 PUBLISHED

Internally found bugs present in Firefox 154, Firefox ESR 153.1 and Firefox ESR 140.14. Some of these bugs showed evidence of memory corruption or another security-relevant defect and we presume that with enough effort some of these could have been exploited. This vulnerability was fixed in Firefox 155, Firefox ESR 140.15, and Firefox ESR 153.2.

• Jan de Mooij, Tom Ritter and the Mozilla Fuzzing Team

• High Severity internally found bugs fixed in Firefox 155, Firefox ESR 153.2 and Firefox ESR 140.15
• Moderate Severity internally found bugs fixed in Firefox 155, Firefox ESR 153.2 and Firefox ESR 140.15
• Low Severity internally found bugs fixed in Firefox 155, Firefox ESR 153.2 and Firefox ESR 140.15
• https://www.mozilla.org/security/advisories/mfsa2026-82/
• https://www.mozilla.org/security/advisories/mfsa2026-84/
• https://www.mozilla.org/security/advisories/mfsa2026-85/