HIGH🇵🇱 Wersja polska

CVE-2026-84131

CVSS 8.8v3.1pub. 2026-09-01upd. 2026-09-03

Privilege escalation due to invalid pointer in the Graphics component. This vulnerability was fixed in Firefox 155, Firefox ESR 115.40, Firefox ESR 140.15, Firefox ESR 153.2, Thunderbird 155, Thunderbird 140.15, and Thunderbird 153.2.

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

  • Mozilla Firefox

    APP
    Mozilla
    < 115.40.0116.0 – 140.15.0 (excl.)141.0.0 – 153.2.0 (excl.)154.0.0 – 155.0.0 (excl.)

  • Mozilla Thunderbird

    APP
    Mozilla
    < 140.15.0141.0 – 153.2.0 (excl.)154.0 – 155.0 (excl.)
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
Tags
LPE
CWE
References

Related vulnerabilities

CVE-2024-9680CRITICAL9.8⚠ KEVPL ✓same product

Use-after-free w Animation timelines Firefox/Thunderbird — RCE

CVE-2022-26486CRITICAL9.6⚠ KEVPL ✓same product

Use-after-free w WebGPU IPC framework Mozilla — sandbox escape

CVE-2019-11708CRITICAL10.0⚠ KEVPL ✓same product

Mozilla Firefox/Thunderbird: przełamanie sandbox przez IPC Prompt:Open

CVE-2010-3765CRITICAL9.8⚠ KEVPL ✓same product

RCE w Mozilla Firefox przez błąd nsCSSFrameConstructor::ContentAppended

CVE-2026-84119CRITICAL9.6same product

Sandbox escape due to use-after-free in the DOM: Navigation component. This vulnerability was fixed in Firefox...