CVE-2026-84135: Critical Firefox Focus for Android Vulnerability (CVSS 9.8) — Detection and Remediation Guide

NVD has published CVE-2026-84135, a CVSS 9.8 (CRITICAL) vulnerability affecting Firefox Focus for Android, Mozilla's privacy-centric mobile browser deployed widely across consumer and enterprise Android fleets. The vulnerability carries a NETWORK attack vector, meaning exploitation requires no local access and no user interaction beyond normal network-facing browser activity — the worst-case combination for a client-side mobile component.

Per the NVD record, this is classified as an "other issue" in Firefox Focus for Android and was fixed in Firefox 155. While Mozilla's public description is sparse, a 9.8 network-exploitable score against a mobile browser demands we treat this as potentially remote-code-execution-adjacent until proven otherwise. Browsers are the single largest attack surface on mobile devices: they parse untrusted content from arbitrary origins all day, every day.

If your organization allows BYOD, manages Android devices through an MDM, or has users browsing on Firefox Focus, this needs to be in your patch queue this week.

Reference: NVD — CVE-2026-84135

Technical Analysis

Affected Products and Versions

• Product: Firefox Focus for Android
• Affected versions: All versions prior to Firefox 155
• Fixed version: Firefox 155 (and corresponding Firefox Focus 155 builds distributed via Google Play)
• Platform: Android

Firefox Focus shares its rendering and networking stack lineage with mainline Firefox for Android, but note that the CVE as published specifically names Firefox Focus for Android as the affected component. Do not assume your desktop Firefox or standard Firefox for Android installs are covered by this advisory unless Mozilla's corresponding security advisory states otherwise — verify against the NVD record and Mozilla Foundation Security Advisories.

Vulnerability Profile

A CVSS 9.8 with a network vector against a browser component typically implies one of the following classes of defects (Mozilla has not published granular technical detail in the summary record, so defenders should plan against the full range):

• Memory corruption in content parsing (rendering engine, media decoders, image/font libraries) reachable by hostile web content
• Network-facing input validation failures in HTTP, TLS, or WebRTC handling
• Same-origin or sandbox escape conditions enabling privilege escalation from web content to the app context

The practical exploitation model for a mobile browser flaw of this class is drive-by compromise: a user visits a malicious or compromised page (or loads malicious ad content), and the attacker achieves code execution within the browser's process context — potentially followed by sandbox escape to full device control. Android's app sandbox limits blast radius, but browser-context code execution alone is sufficient for session theft, credential harvesting, and surveillance.

Exploitation Status

At the time of writing:

• No public proof-of-concept has been observed for CVE-2026-84135.
• The CVE has not yet been added to the CISA Known Exploited Vulnerabilities (KEV) catalog — monitor this closely, as critical mobile browser CVEs are frequent KEV additions.
• Given the severity score and network vector, defenders should operate on the assumption that weaponization is a matter of time, particularly by commercial spyware and mobile APT actors who actively target Android browser stacks.

The window between patch release and exploit development for critical browser bugs is historically measured in days to weeks. Patch now, not after KEV listing.

Detection & Response

There are no public IOCs for CVE-2026-84135. The highest-fidelity detective control available today is identifying vulnerable Firefox Focus builds in your environment — via MDM inventory, network telemetry (User-Agent inspection), and log analysis. Outdated-app detection is precise, low-noise, and directly actionable.

Sigma Rules

The following rules target proxy and network security telemetry to surface devices running pre-155 Firefox Focus builds. These are inventory-style detections — tune them into a hunting dashboard rather than paging alerts.

---
title: Outdated Firefox Focus for Android User-Agent Detected (CVE-2026-84135 Exposure)
id: 4c1b9e72-6a3d-4f58-b9a1-2e7d5c8f0a33
status: experimental
description: Detects HTTP traffic from Firefox Focus for Android builds below version 155, indicating devices exposed to CVE-2026-84135. Firefox Focus embeds its version in the User-Agent string.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-84135
author: Security Arsenal
date: 2026/06/15
tags:
  - attack.initial_access
  - attack.t1189
logsource:
  category: proxy
detection:
  selection:
    c-useragent|contains:
      - 'Focus/'
      - 'Firefox Focus'
  filter_patched:
    c-useragent|contains:
      - 'Focus/155'
      - 'Focus/156'
      - 'Focus/157'
      - 'Focus/158'
      - 'Focus/159'
      - 'Focus/16'
      - 'Focus/17'
  condition: selection and not filter_patched
falsepositives:
  - Devices intentionally pinned to older builds for testing
level: medium
---
title: Firefox Focus Outdated Build via Web Server Access Logs (CVE-2026-84135 Exposure)
id: 8d2f4a16-9c7b-4e35-a6d8-1f0b3e5c7d92
status: experimental
description: Detects inbound requests to corporate web applications from unpatched Firefox Focus for Android clients, identifying exposed users authenticating to internal services.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-84135
author: Security Arsenal
date: 2026/06/15
tags:
  - attack.initial_access
  - attack.t1189
logsource:
  category: webserver
detection:
  selection:
    cs-user-agent|contains:
      - 'Focus/1'
  filter_current:
    cs-user-agent|contains:
      - 'Focus/155'
      - 'Focus/156'
      - 'Focus/157'
      - 'Focus/158'
      - 'Focus/159'
  condition: selection and not filter_current
falsepositives:
  - Lab or test devices on pinned versions
level: low

KQL — Microsoft Sentinel / Defender

This query hunts proxy/firewall telemetry ingested into CommonSecurityLog (CEF from Zscaler, Palo Alto, Fortinet, Squid, etc.) for Firefox Focus User-Agents below build 155, giving you a device/user inventory of unpatched clients. A second variant runs against Defender network events where UA strings are logged.

// Hunt: Unpatched Firefox Focus for Android (pre-155) in network telemetry — CVE-2026-84135
CommonSecurityLog
| where TimeGenerated > ago(14d)
| where RequestClientApplication has_cs "Focus/"
| extend FocusUA = tostring(RequestClientApplication)
| extend FocusVersion = toint(extract(@"Focus/(\d+)", 1, FocusUA))
| where isnotnull(FocusVersion) and FocusVersion < 155
| summarize FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated), Requests = count()
    by SourceIP, SourceUserID, FocusVersion, DeviceName
| sort by LastSeen desc

// Alternate: hunt via Syslog-ingested web proxy logs (e.g., Squid, Blue Coat forwarded via syslog)
Syslog
| where TimeGenerated > ago(14d)
| where SyslogMessage has "Focus/"
| extend FocusVersion = toint(extract(@"Focus/(\d+)", 1, SyslogMessage))
| where isnotnull(FocusVersion) and FocusVersion < 155
| summarize Hits = count(), DistinctHosts = dcount(HostIP) by FocusVersion, Computer
| sort by Hits desc

Velociraptor VQL

For organizations forwarding web proxy or WAF logs to a Velociraptor-monitored log server, this artifact parses access logs to build an inventory of unpatched Firefox Focus clients — useful for scoping exposure during an IR or patch-verification sweep.

-- Artifact: Inventory of unpatched Firefox Focus for Android clients (CVE-2026-84135)
-- Parses proxy/web access logs for Focus/<version> User-Agents below build 155
LET log_lines = SELECT Line
FROM parse_lines(filename="/var/log/squid/access.log")
WHERE Line =~ "Focus/"

SELECT
  Line,
  parse_string_with_regex(regex="Focus/(?P<Ver>[0-9]+)", string=Line).Ver AS FocusVersion,
  parse_string_with_regex(regex="^(?P<Src>[0-9.]+)", string=Line).Src AS SourceIP
FROM log_lines
WHERE to_int(string=FocusVersion) < 155
GROUP BY FocusVersion, SourceIP

Remediation Script

This PowerShell script uses Microsoft Graph (Intune) to inventory managed Android devices with Firefox Focus installed below version 155, producing a compliance report you can hand to your endpoint team or wire into a remediation pipeline.

# CVE-2026-84135 - Firefox Focus for Android exposure inventory via Microsoft Graph/Intune
# Requires: Microsoft.Graph PowerShell SDK with DeviceManagementApps.Read.All / DeviceManagementManagedDevices.Read.All

Connect-MgGraph -Scopes "DeviceManagementApps.Read.All","DeviceManagementManagedDevices.Read.All"

$fixedVersion = [version]"155.0"
$results = @()

# Enumerate detected apps across managed devices
$apps = Get-MgDeviceManagementDetectedApp -All | Where-Object {
    $_.DisplayName -match "Firefox Focus" -or $_.DisplayName -match "Focus"
}

foreach ($app in $apps) {
    $devices = Get-MgDeviceManagementDetectedAppManagedDevice -DetectedAppId $app.Id -All
    foreach ($dev in $devices) {
        $installed = $null
        try { $installed = [version]($app.Version -replace '[^0-9.].*$','') } catch {}
        $results += [pscustomobject]@{
            DeviceName     = $dev.DeviceName
            AppName        = $app.DisplayName
            InstalledVer   = $app.Version
            Vulnerable     = if ($installed) { $installed -lt $fixedVersion } else { "Unknown - verify manually" }
            CVE            = "CVE-2026-84135"
        }
    }
}

$results | Where-Object { $_.Vulnerable -eq $true } |
    Export-Csv -Path ".\CVE-2026-84135-VulnerableDevices.csv" -NoTypeInformation

Write-Host "Vulnerable devices found: $(($results | Where-Object {$_.Vulnerable -eq $true}).Count)"
Write-Host "Report written to .\CVE-2026-84135-VulnerableDevices.csv"

# Verification for standalone proxies: grep access logs for outdated Focus builds (run on log host via Bash instead)

# CVE-2026-84135 - Quick exposure sweep of proxy/web logs for unpatched Firefox Focus builds
# Run on your log host or SIEM syslog collector
grep -hoE 'Focus/[0-9]+' /var/log/squid/access.log* 2>/dev/null \
  | sort -u | awk -F/ '{ if ($2+0 < 155) print "VULNERABLE: Focus/"$2 }'

# Count distinct source IPs still running pre-155 builds
grep -E 'Focus/1[0-4][0-9]|Focus/[0-9]{1,2}[^0-9]' /var/log/squid/access.log 2>/dev/null \
  | awk '{print $1}' | sort -u | wc -l

Remediation

1. Patch immediately. Update Firefox Focus for Android to Firefox 155 or later via Google Play. The fix is distributed through the Play Store — there is no sideload or manual APK path you should be endorsing for managed devices.

2. Enforce via MDM. For Intune, Workspace ONE, or other UEM-managed fleets:

   • Push Firefox Focus 155+ as a required/managed app update.
   • Create a compliance policy that flags (or restricts access from) devices running pre-155 builds.
   • On fully managed Android Enterprise devices, block install of unmanaged browser packages where policy permits.

3. Force auto-update on BYOD. Where you cannot mandate app versions, require users to enable Google Play auto-update and communicate the CVE directly. A 9.8 network-exploitable browser bug is an easy justification for a push notification to end users.

4. Monitor CISA KEV. Critical mobile browser vulnerabilities are disproportionately represented in KEV once exploitation begins. If CVE-2026-84135 is added, federal civilian agencies face a binding remediation deadline under BOD 22-01, and private organizations should treat the KEV due date as their own SLA.

5. Reduce the attack surface in the interim. If any device cannot be patched (legacy Android builds pinned to old WebView/app versions):

   • Restrict browsing to an allowlisted set of business-required domains via DNS filtering or secure web gateway policy.
   • Consider temporarily mandating a patched alternative browser on affected devices.
   • Increase monitoring on network traffic from those devices (the Sigma and KQL content above gives you the inventory to target).

6. Verify patch compliance. Do not trust self-reporting. Use the Graph/Intune inventory script and proxy-log User-Agent hunts above to confirm 155+ adoption across the fleet, and track residual exposure to zero.

Vendor and advisory references:

• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-84135
• Mozilla Foundation Security Advisories: https://www.mozilla.org/en-US/security/advisories/

Bottom Line

CVE-2026-84135 is a textbook "patch fast, verify with telemetry" scenario: a critical, network-exploitable defect in a browser that processes untrusted content constantly. There is no public exploit today — which is exactly when patching is cheapest. Inventory your Firefox Focus installs, push 155, and set up the User-Agent hunts above to catch stragglers before an exploit kit does.

Related Resources

Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub