critical 9.6

CVE-2026-84121 json

Sandbox escape due to use-after-free in the DOM: Security component

published 2026-09-01 2 mo ago modified 2026-09-02 2 mo ago also EUVD-2026-69066

cvss: 9.6; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.3%; EPSS 0.3% chance of exploitation in 30 days, percentile 25%
public exploits: 0; none known

Sandbox escape due to use-after-free in the DOM: Security component. This vulnerability was fixed in Firefox 155, Firefox ESR 115.40, Firefox ESR 140.15, Firefox ESR 153.2, Thunderbird 155, Thunderbird 140.15, and Thunderbird 153.2.

Patch / fix

fixed in 2 distros 6

mozilla firefox 115.40.0, 140.15.0, 153.2.0, 155.0.0
mozilla thunderbird 140.15.0, 153.2.0, 155.0

debian red hat suse opensuse almalinux rocky linux

firefox-esr Debian 12 140.15.0esr-1~deb12u1
firefox-esr Debian 13 140.15.0esr-1~deb13u1
firefox-esr Debian 14 140.15.0esr-1
thunderbird Debian 12 1:140.15.0esr-1~deb12u1
thunderbird Debian 13 1:140.15.0esr-1~deb13u1
thunderbird Debian 14 1:153.2.0esr-1

debian advisories DEBIAN-CVE-2026-84121

thunderbird RHEL 8 140.16.0-1.el8_10
thunderbird RHEL 10.2 140.16.0-1.el10_2
firefox RHEL 8 140.15.0-1.el8_10
firefox RHEL 9 140.15.0-1.el9_8
firefox-x11 RHEL 9 140.15.0-1.el9_8
firefox RHEL 10.2 140.15.0-1.el10_2
thunderbird RHEL 9 140.16.0-1.el9_8
thunderbird RHEL 8.4 EUS_LONG_LIFE, RHEL 8.4 AUS 140.16.0-1.el8_4

red hat advisories RHSA-2026:82122 RHSA-2026:81913 RHSA-2026:81912 RHSA-2026:80503 RHSA-2026:77632 RHSA-2026:77631

MozillaThunderbird SLE Workstation Extension 15 SP7, SLE Module for Package Hub 15 SP7 153.2.0-150400.13.3.1
MozillaFirefox SLES for SAP applications 16.0, SLES 16.0 153.2.0-160000.1.1
mozilla-nss SLES for SAP 15 SP6, SLES for SAP 15 SP5, SLES for SAP 15 SP4 +11 more 3.125-150400.3.74.1
mozilla-nspr SLES for SAP 15 SP6, SLES for SAP 15 SP5, SLES for SAP 15 SP4 +11 more 4.39-150400.12.3.1
MozillaFirefox SLES for SAP 15 SP6, SLES for SAP 15 SP5, SLES for SAP 15 SP4 +8 more 153.2.0-150400.157.5.1
MozillaFirefox-branding-SLE SLES for SAP 15 SP6, SLES for SAP 15 SP5, SLES for SAP 15 SP4 +8 more 153-150400.14.3.1
mozilla-nss SLES LTSS Extended Security 12 SP5, SLES 12 SP5-LTSS 3.125-58.147.1
mozilla-nspr SLES LTSS Extended Security 12 SP5, SLES 12 SP5-LTSS 4.39-19.39.1

suse advisories SUSE-SU-2026:4268-1 SUSE-SU-2026:23784-1 SUSE-SU-2026:4156-1 SUSE-SU-2026:4140-1

MozillaFirefox openSUSE Leap 16.0 153.2.0-160000.1.1
MozillaFirefox openSUSE Tumbleweed 155.0-1.1
MozillaThunderbird openSUSE Tumbleweed 140.15.0-1.1
firefox-esr openSUSE Tumbleweed 153.2.0-1.1

opensuse advisories openSUSE-SU-2026:21853-1 openSUSE-SU-2026:11677-1 openSUSE-SU-2026:11678-1 openSUSE-SU-2026:11666-1

thunderbird AlmaLinux 8 140.16.0-1.el8_10.alma.1
thunderbird AlmaLinux 10 140.16.0-1.el10_2.alma.1
thunderbird AlmaLinux 9 140.16.0-1.el9_8.alma.1
firefox AlmaLinux 8 140.15.0-1.el8_10.alma.1
firefox AlmaLinux 10 140.15.0-1.el10_2
firefox AlmaLinux 9 140.15.0-1.el9_8.alma.1
firefox-x11 AlmaLinux 9 140.15.0-1.el9_8.alma.1

almalinux advisories ALSA-2026:73971 ALSA-2026:73130 ALSA-2026:70642 ALSA-2026:68549 ALSA-2026:67129 ALSA-2026:67133

thunderbird Rocky Linux 8 140.16.0-1.el8_10
thunderbird Rocky Linux 10 140.16.0-1.el10_2
firefox Rocky Linux 10 140.15.0-1.el10_2
firefox Rocky Linux 9 140.15.0-1.el9_8
firefox Rocky Linux 8 140.15.0-1.el8_10
thunderbird Rocky Linux 9 140.16.0-1.el9_8

rocky linux advisories RLSA-2026:73971 RLSA-2026:73130 RLSA-2026:67129 RLSA-2026:67133 RLSA-2026:68549 RLSA-2026:70642

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-84121 updated 2026-11-04 cvss 7.5

firefox: Sandbox escape due to use-after-free in the DOM: Security component

Red Hat Enterprise Linux 6 firefox, thunderbird Red Hat Enterprise Linux 7 thunderbird
affected: no fix planned “Out of support scope”
Red Hat Enterprise Linux 10 rhel10/firefox-flatpak, rhel10/thunderbird-flatpak
affected: no fix available
Red Hat Enterprise Linux AppStream (v. 8) firefox 140.15.0-1.el8_10, thunderbird 140.16.0-1.el8_10
fixed: vendor fix RHSA-2026:68549
Red Hat Enterprise Linux AppStream (v. 9) firefox 140.15.0-1.el9_8, firefox-x11 140.15.0-1.el9_8, thunderbird 140.16.0-1.el9_8
fixed: vendor fix RHSA-2026:67133
Red Hat Enterprise Linux AppStream (v. 10) firefox 140.15.0-1.el10_2, thunderbird 140.16.0-1.el10_2
fixed: vendor fix RHSA-2026:67129
Red Hat Enterprise Linux AppStream AUS (v.8.4) firefox 140.15.0-1.el8_4, thunderbird 140.16.0-1.el8_4
fixed: vendor fix RHSA-2026:76894
Red Hat Enterprise Linux AppStream AUS (v.8.6) firefox 140.15.0-1.el8_6, thunderbird 140.16.0-1.el8_6
fixed: vendor fix RHSA-2026:76745
Red Hat Enterprise Linux AppStream E4S (v.8.8) firefox 140.15.0-1.el8_8, thunderbird 140.16.0-1.el8_8
fixed: vendor fix RHSA-2026:76746

show 8 more

Red Hat Enterprise Linux AppStream E4S (v.9.2) firefox 140.15.0-1.el9_2, firefox-x11 140.15.0-1.el9_2, thunderbird 140.15.0-1.el9_2
fixed: vendor fix RHSA-2026:76742
Red Hat Enterprise Linux AppStream E4S (v.9.4) firefox 140.15.0-1.el9_4, firefox-x11 140.15.0-1.el9_4, thunderbird 140.15.0-1.el9_4
fixed: vendor fix RHSA-2026:76740
Red Hat Enterprise Linux AppStream EUS (v. 10.0) firefox 140.15.0-1.el10_0, thunderbird 140.15.0-1.el10_0
fixed: vendor fix RHSA-2026:77610
Red Hat Enterprise Linux AppStream EUS (v.9.6) firefox 140.15.0-1.el9_6, firefox-x11 140.15.0-1.el9_6, thunderbird 140.15.0-1.el9_6
fixed: vendor fix RHSA-2026:76895
Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4) firefox 140.15.0-1.el8_4, thunderbird 140.16.0-1.el8_4
fixed: vendor fix RHSA-2026:76894
Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6) firefox 140.15.0-1.el8_6, thunderbird 140.16.0-1.el8_6
fixed: vendor fix RHSA-2026:76745
Red Hat Enterprise Linux AppStream TUS (v.8.8) firefox 140.15.0-1.el8_8, thunderbird 140.16.0-1.el8_8
fixed: vendor fix RHSA-2026:76746
Red Hat Enterprise Linux Server (v. 7 ELS) firefox 140.15.0-1.el7_9
fixed: vendor fix RHSA-2026:76741

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation: none
Automatable: no
Technical impact: total
Assessed: 2 mo ago (2026-09-01)

Exploit prediction

0.32% chance of exploitation in the next 30 days, higher than 25% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CISA ADP	3.1	9.6	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
CNA	3.1	9.6	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Affected products

Mozilla Firefox
Mozilla Thunderbird

Classification

Weakness

CWE-416 Use After Free

References

mozilla.org /security/advisories/mfsa2026-82/
vendor-advisory
mozilla.org /security/advisories/mfsa2026-83/
vendor-advisory
mozilla.org /security/advisories/mfsa2026-84/
vendor-advisory
mozilla.org /security/advisories/mfsa2026-85/
vendor-advisory
mozilla.org /security/advisories/mfsa2026-86/
vendor-advisory
mozilla.org /security/advisories/mfsa2026-87/
vendor-advisory
mozilla.org /security/advisories/mfsa2026-88/
vendor-advisory
bugzilla.mozilla.org /show_bug.cgi?id=2059018
permissions-required

Sources

CVE List CVE-2026-84121
NVD CVE-2026-84121

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary