Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-84135: Firefox Focus for Android may run malicious code

CVE-2026-84135 · published 1 month ago

Summary

A bug in Firefox Focus for Android and related Firefox components could let an attacker cause the app to execute unwanted code. This can affect the browser and its JavaScript engine on devices that haven’t been updated. Update Firefox Focus (and any Mozilla Firefox apps) to the latest version to protect yourself.

What to do

Update mozilla firefox_mobile to version 155.0 or later.

Affected software

Ecosystem	Vendor	Product	Affected versions
–	mozilla	firefox	All versions
Ubuntu:18.04:LTS	canonical	mozjs52	All versions
Ubuntu:18.04:LTS	canonical	mozjs38	All versions
Ubuntu:20.04:LTS	canonical	mozjs68	All versions
Ubuntu:22.04:LTS	canonical	mozjs102	All versions
Ubuntu:22.04:LTS	canonical	mozjs78	All versions
Ubuntu:22.04:LTS	canonical	mozjs91	All versions
Ubuntu:22.04:LTS	canonical	thunderbird	All versions
Ubuntu:24.04:LTS	canonical	mozjs115	All versions
–	mozilla	firefox_mobile	< 155.0 `cpe:2.3:a:mozilla:firefox_mobile::::::android::*`

Original advisory text

Other issue in Firefox Focus for Android

Other issue in Firefox Focus for Android. This vulnerability was fixed in Firefox 155.

References

https://ubuntu.com/security/CVE-2026-84135 Third Party Advisory
https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/84xxx/CVE-2026-84135... Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-84135 Vendor Advisory
https://bugzilla.mozilla.org/show_bug.cgi?id=2046661 Issue Tracking Permissions Required
https://www.mozilla.org/security/advisories/mfsa2026-82/ Vendor Advisory
https://www.cve.org/CVERecord?id=CVE-2026-84135 Third Party Advisory
https://www.mozilla.org/en-US/security/advisories/mfsa2026-82/#CVE-2026-84135 Third Party Advisory

Fix within

Internet-facing 3 days

Internal 60 days

Not known to be exploited
Can be exploited automatically
Gives an attacker full control

Severity

9.8 Critical

Exploitation

<1% chance of attack within 30 days

Type

CWE-20Improper Input Validation

CWE-200Information Exposure

Timeline

Published1 Sep 2026

Updated11 Oct 2026

First seen1 Sep 2026

Sources

CVE-2026-84135 · NVD

CVE-2026-84135 · MITRE

UBUNTU-CVE-2026-84135 · OSV

CVE-2026-84135 · OSV

Track software like this

Free during beta