Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.8
CVE-2026-84134: Firefox/Thunderbird profile backup may allow data manipulation
CVE-2026-84134 · published 1 month ago
Summary
The profile backup feature in Firefox, Thunderbird and related Mozilla JavaScript components can be tricked into storing altered information. This could let an attacker change user settings or inject unwanted code when the backup is restored. Update Firefox to version 155 (or later), Firefox ESR to 153.2 (or later), Thunderbird to 155 (or later), or Thunderbird to 153.2 (or later) to fix the problem.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| – | mozilla | firefox |
< 153.2.0 >= 154.0.0, < 155.0.0 |
| – | mozilla | thunderbird |
< 153.2.0 >= 154.0, < 155.0 |
| Ubuntu:22.04:LTS | canonical | mozjs102 | All versions |
| Ubuntu:22.04:LTS | canonical | mozjs78 | All versions |
| Ubuntu:22.04:LTS | canonical | mozjs91 | All versions |
| Ubuntu:18.04:LTS | canonical | mozjs52 | All versions |
| Ubuntu:18.04:LTS | canonical | mozjs38 | All versions |
| Ubuntu:20.04:LTS | canonical | mozjs68 | All versions |
| Ubuntu:22.04:LTS | canonical | thunderbird | All versions |
| Ubuntu:24.04:LTS | canonical | mozjs115 | All versions |
Original advisory text
Other issue in the Profile Backup component. This vulnerability was fixed in Firefox 155, Firefox ESR 153.2, Thunderbird 155, and Thunderbird 153.2.
Other issue in the Profile Backup component. This vulnerability was fixed in Firefox 155, Firefox ESR 153.2, Thunderbird 155, and Thunderbird 153.2.
References
- https://bugzilla.mozilla.org/show_bug.cgi?id=2044882 Permissions Required
- https://www.mozilla.org/security/advisories/mfsa2026-82/ Vendor Advisory
- https://www.mozilla.org/security/advisories/mfsa2026-85/ Vendor Advisory
- https://www.mozilla.org/security/advisories/mfsa2026-86/ Vendor Advisory
- https://www.mozilla.org/security/advisories/mfsa2026-88/ Vendor Advisory
- https://ubuntu.com/security/CVE-2026-84134 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2026-84134 Third Party Advisory
- https://www.mozilla.org/en-US/security/advisories/mfsa2026-82/#CVE-2026-84134 Third Party Advisory
Internet-facing
3 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically
- Gives an attacker full control
Severity
9.8
Critical
Type
CWE-200Information Exposure
Timeline
Published1 Sep 2026
Updated11 Oct 2026
First seen1 Sep 2026
Track software like this
Free during beta