CVE-2026-84140 and Three More Critical Firefox/Thunderbird CVEs (CVSS 9.8): Detection and Remediation Guide

NVD has published four CRITICAL-severity, network-vector vulnerabilities affecting Mozilla Firefox and Thunderbird in the last 72 hours: CVE-2026-84140, CVE-2026-84141, CVE-2026-84142, and CVE-2026-84143 — all carrying CVSS base scores up to 9.8. Mozilla shipped fixes in Firefox 155, Firefox ESR 153.2, Thunderbird 155, and Thunderbird ESR 153.2 (Thunderbird ESR 140.14 is also implicated in CVE-2026-84143).

This is not a drill-your-inventory exercise. Three of the four CVEs describe memory corruption and sandbox-relevant flaws in components reachable by remote, unauthenticated content — a malicious web page in Firefox's case, and a malicious email or embedded remote content in Thunderbird's. A CVSS 9.8 network-vector score on a browser or mail client means the exploit delivery mechanism is a link click or an email render — two of the highest-frequency user actions in any enterprise. If your organization runs Firefox or Thunderbird, treat this as an emergency patch cycle, not a routine one.

Technical Analysis

Affected Products and Fixed Versions

The CVEs

CVE-2026-84140 (CVSS 9.8) — Site isolation failure in DOM: Navigation. Site isolation (Mozilla's Fission architecture) is the control that keeps a compromised renderer process from reaching cross-origin data. A flaw in the Navigation component that breaks this boundary is precisely the class of bug exploit chains are built around: renderer compromise first, then a site-isolation escape to read cross-origin data or pivot toward privilege escalation. Defenders should assume this is the CVE most attractive to sophisticated actors, because it degrades the browser's core security boundary rather than just crashing a process.

CVE-2026-84141 (CVSS 9.8) — Integer overflow in Graphics: ImageLib. Image decoding libraries are one of the most historically fruitful attack surfaces in browsers (ImageLib handles parsing of attacker-supplied image formats rendered automatically by web pages and HTML email). An integer overflow here is a classic precursor to heap corruption and arbitrary code execution. Critically, image rendering requires zero user interaction beyond viewing a page or an HTML email — this is a drive-by primitive.

CVE-2026-84142 (CVSS 9.8) — Memory corruption bugs in Thunderbird 154 (internally found). Mozilla's rollup advisories for internally discovered memory safety bugs carry the standard caveat that some showed evidence of memory corruption, and Mozilla's standing position is that with sufficient effort these could be exploited to run arbitrary code. The fact that these were found internally does not reduce the risk — it means the bug class is confirmed present and reachable in shipping code.

CVE-2026-84143 (CVSS 9.8) — Memory corruption bugs in Thunderbird 154, Thunderbird ESR 153.1, and ESR 140.14. Same class as above, but spanning both the release and both ESR trains — meaning organizations that pinned to ESR for stability are just as exposed and must move to ESR 153.2.

Exploitation Requirements and Realistic Attack Chain

From a defender's perspective, the delivery model is:

1. Lure — phishing email or watering-hole page delivering a crafted URL (Firefox) or a crafted HTML email / remote image (Thunderbird).
2. Trigger — ImageLib integer overflow (CVE-2026-84141) or memory corruption (CVE-2026-84142/84143) fires during rendering. No macro, no attachment execution, no explicit user consent beyond viewing content.
3. Escape / pivot — CVE-2026-84140 weakens the site isolation boundary, enabling cross-origin data theft or chaining toward a sandbox escape.
4. Post-exploitation — child process spawn from firefox.exe/thunderbird.exe, payload staging, credential access, persistence.

Exploitation status: As of publication, there is no confirmed in-the-wild exploitation and no public PoC for these CVEs, and they have not yet been added to CISA's Known Exploited Vulnerabilities catalog. The bugs were discovered internally at Mozilla. That is the good news. The bad news: Mozilla's public advisories and the source commits behind these fixes give motivated exploit developers a roadmap — browser patch diffing is a mature discipline, and the window between patch release and working exploit for CVSS 9.8 browser bugs is measured in days to weeks, not months. Patch before that window closes.

Detection & Response

Because these are memory-corruption and isolation flaws triggered by rendered content, pre-exploitation detection is limited to version hygiene and crash telemetry. Post-exploitation detection, however, is highly actionable: a successfully exploited browser almost always does something a browser should never do — spawn shells, script interpreters, or LOLBins as child processes, or establish outbound connections from unexpected child processes. That is where your detections should concentrate.

Sigma Rules

The following rules target post-exploitation behavior consistent with browser/mail-client compromise. They are intentionally narrow — firefox.exe and thunderbird.exe spawning command interpreters, script hosts, or Office-adjacent LOLBins is high-fidelity in virtually every environment. Note that Firefox's own updater and crash reporter child processes are explicitly excluded where applicable.

---
title: Firefox or Thunderbird Spawning Command Interpreter or Script Host
id: 3f8a2c14-7b6e-4d91-a2c5-9e1f0b4d8a72
status: experimental
description: Detects firefox.exe or thunderbird.exe spawning cmd.exe, powershell, wscript, cscript, mshta, rundll32, or regsvr32 — a strong post-exploitation indicator consistent with browser/mail-client memory corruption exploitation such as CVE-2026-84140/84141/84142/84143.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-84140
  - https://attack.mitre.org/techniques/T1203/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.execution
  - attack.t1203
  - attack.t1059
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\firefox.exe'
      - '\thunderbird.exe'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
      - '\regsvr32.exe'
      - '\wmic.exe'
      - '\bitsadmin.exe'
      - '\certutil.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Rare legitimate browser extension or enterprise SSO helper behavior — investigate parent-child command lines before tuning
level: high
---
title: Browser Process Writing Executable to User-Writable or Temp Directory
id: 9c1e5b07-4a2f-4e88-b3d1-6f7a0c2e9d45
status: experimental
description: Detects firefox.exe or thunderbird.exe writing PE files to temp, AppData, or Public directories — consistent with payload staging after successful exploitation of renderer-level memory corruption (e.g., CVE-2026-84141 ImageLib integer overflow).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-84140
  - https://attack.mitre.org/techniques/T1203/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.execution
  - attack.t1203
logsource:
  category: file_event
  product: windows
detection:
  selection_image:
    Image|endswith:
      - '\firefox.exe'
      - '\thunderbird.exe'
  selection_path:
    TargetFilename|contains:
      - '\AppData\Local\Temp\'
      - '\AppData\Roaming\'
      - '\Users\Public\'
      - '\Windows\Temp\'
  selection_ext:
    TargetFilename|endswith:
      - '.exe'
      - '.dll'
      - '.scr'
      - '.bat'
      - '.ps1'
  filter_cache:
    TargetFilename|contains:
      - '\AppData\Roaming\Mozilla\Firefox\Profiles\'
      - '\AppData\Roaming\Thunderbird\Profiles\'
  condition: selection_image and selection_path and selection_ext and not filter_cache
falsepositives:
  - Browser downloads initiated by the user — correlate with download history and command-line telemetry
level: medium
---
title: Repeated Firefox or Thunderbird Child Process Crashes
id: 6d4b9f31-2e7c-4a5d-9f83-1b8c6e0a5d29
status: experimental
description: Detects crash reporter execution for Firefox or Thunderbird, which in volume can indicate exploit attempts against memory corruption vulnerabilities (CVE-2026-84141/84142/84143) failing against a hardened target. Baseline crash rates before alerting on single events.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-84140
  - https://attack.mitre.org/techniques/T1203/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.execution
  - attack.t1203
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith:
      - '\crashreporter.exe'
    CommandLine|contains:
      - 'firefox'
      - 'thunderbird'
  condition: selection
falsepositives:
  - Ordinary browser instability — alert on frequency and clustering per host, not single events
level: low

KQL — Microsoft Sentinel / Defender

Two hunts: the first is the high-fidelity post-exploitation hunt (browser spawning shells/LOLBins). The second is a vulnerability exposure inventory — it enumerates every endpoint still running a vulnerable Firefox or Thunderbird build via Defender file version telemetry, which is the fastest way to drive your patch campaign to zero.

// Hunt 1: Post-exploitation behavior — Firefox/Thunderbird spawning suspicious child processes
DeviceProcessEvents
| where TimeGenerated > ago(7d)
| where InitiatingProcessFileName in~ ("firefox.exe", "thunderbird.exe")
| where FileName in~ ("cmd.exe", "powershell.exe", "pwsh.exe", "wscript.exe", "cscript.exe",
                      "mshta.exe", "rundll32.exe", "regsvr32.exe", "wmic.exe", "bitsadmin.exe",
                      "certutil.exe", "schtasks.exe", "regsvr32.exe")
| project TimeGenerated, DeviceName, AccountName, InitiatingProcessFileName,
          InitiatingProcessCommandLine, FileName, ProcessCommandLine, SHA256, FolderPath
| order by TimeGenerated desc

// Hunt 2: Exposure inventory — endpoints running vulnerable Firefox/Thunderbird versions
// Fixed versions: Firefox 155+, Firefox ESR 153.2+, Thunderbird 155+, Thunderbird ESR 153.2+
DeviceFileEvents
| where TimeGenerated > ago(14d)
| where FileName in~ ("firefox.exe", "thunderbird.exe")
| where FolderPath has_any ("Mozilla Firefox", "Mozilla Thunderbird", "Firefox ESR")
| summarize LastSeen = max(TimeGenerated), FileVersion = any(FileVersion) by DeviceName, FileName, FolderPath
| extend MajorVersion = toint(split(FileVersion, ".")[0]),
         MinorVersion = toint(split(FileVersion, ".")[1])
| extend Vulnerable = case(
    MajorVersion < 153, true,
    MajorVersion == 153 and MinorVersion < 2, true,
    MajorVersion == 154, true,
    false)
| where Vulnerable == true
| project DeviceName, FileName, FolderPath, FileVersion, LastSeen
| order by DeviceName asc

// Hunt 3: Crash clustering — repeated crashreporter executions may indicate failed exploit attempts
DeviceProcessEvents
| where TimeGenerated > ago(7d)
| where FileName =~ "crashreporter.exe"
| where ProcessCommandLine has_any ("firefox", "thunderbird")
| summarize CrashCount = count() by DeviceName, bin(TimeGenerated, 1h)
| where CrashCount >= 5
| order by CrashCount desc

Velociraptor VQL

For DFIR triage on a host you suspect was exploited via one of these CVEs, pull the live process tree and flag any browser process with anomalous children, plus enumerate the installed Firefox/Thunderbird binary versions to confirm patch state:

-- Triage: Firefox/Thunderbird processes with suspicious child processes (post-exploitation indicator)
SELECT Pid, Ppid, Name, Exe, CommandLine, Username, CreateTime
FROM pslist()
WHERE Name =~ '(?i)(firefox|thunderbird)\.exe$'
   OR (Name =~ '(?i)(cmd|powershell|pwsh|wscript|cscript|mshta|rundll32|regsvr32|certutil)\.exe$'
       AND Ppid IN (SELECT Pid FROM pslist() WHERE Name =~ '(?i)(firefox|thunderbird)\.exe$'))

-- Patch verification: enumerate Firefox/Thunderbird installs and versions on disk
SELECT FullPath, Size, Mtime
FROM glob(globs=[
  'C:/Program Files/Mozilla Firefox/firefox.exe',
  'C:/Program Files (x86)/Mozilla Firefox/firefox.exe',
  'C:/Program Files/Mozilla Thunderbird/thunderbird.exe',
  'C:/Program Files (x86)/Mozilla Thunderbird/thunderbird.exe'
])

-- Network check: browser processes with established outbound connections to rare external hosts
SELECT Pid, Name, Pid.Path AS ExePath, Raddr, Rport, Status
FROM netstat()
WHERE Name =~ '(?i)(firefox|thunderbird)'
  AND Status =~ 'ESTAB'

Remediation Script

The following PowerShell script inventories installed Firefox and Thunderbird versions across a Windows endpoint, flags anything below the fixed builds, and reports compliance state — suitable for deployment via Intune, SCCM/MECM, or your RMM as a detection/remediation pair. It does not force-close running browsers; pair it with your standard patching workflow or run with -EnforceUpdate logic in your RMM to push the updated installers.

# CVE-2026-84140/84141/84142/84143 — Firefox/Thunderbird version compliance check
# Fixed: Firefox 155+, Firefox ESR 153.2+, Thunderbird 155+, Thunderbird ESR 153.2+
# Exit 0 = compliant or not installed | Exit 1 = VULNERABLE build detected

$targets = @(
    @{ Name = 'Firefox';     Paths = @("$env:ProgramFiles\Mozilla Firefox\firefox.exe",
                                       "${env:ProgramFiles(x86)}\Mozilla Firefox\firefox.exe") },
    @{ Name = 'Thunderbird'; Paths = @("$env:ProgramFiles\Mozilla Thunderbird\thunderbird.exe",
                                       "${env:ProgramFiles(x86)}\Mozilla Thunderbird\thunderbird.exe") }
)

function Test-VersionVulnerable([version]$v) {
    # Anything on the 154 train or below ESR 153.2 is vulnerable
    if ($v.Major -lt 153) { return $true }
    if ($v.Major -eq 153 -and $v.Minor -lt 2) { return $true }   # ESR 153.0/153.1
    if ($v.Major -eq 154) { return $true }                        # Thunderbird 154 / interim builds
    return $false
}

$vulnerable = $false
foreach ($t in $targets) {
    foreach ($p in $t.Paths) {
        if (Test-Path $p) {
            $ver = [version](Get-Item $p).VersionInfo.ProductVersion
            $status = if (Test-VersionVulnerable $ver) { 'VULNERABLE'; $script:vulnerable = $true } else { 'PATCHED' }
            Write-Output "$($t.Name): $ver at $p — $status"
        }
    }
}

if ($vulnerable) {
    Write-Output 'REMEDIATION REQUIRED: Update to Firefox 155 / Firefox ESR 153.2 / Thunderbird 155 / Thunderbird ESR 153.2'
    Write-Output 'Official installers: https://www.mozilla.org/firefox/all/ | https://www.thunderbird.net/'
    exit 1
} else {
    Write-Output 'Compliant: no vulnerable Firefox/Thunderbird builds detected.'
    exit 0
}

For Linux estates, the equivalent check is trivially scriptable — firefox --version and thunderbird --version return the build string, and anything reporting 154.x, 153.0, 153.1, or older should be flagged. Enforce package-manager pinning (apt, dnf, or your config management tool) to pull the fixed builds, and be aware that distro-shipped Firefox packages (Snap, distro repos) may lag Mozilla's direct builds — verify the actual binary version, not the package manager's assumption.

Remediation

1. Patch immediately. Deploy Firefox 155, Firefox ESR 153.2, Thunderbird 155, and Thunderbird ESR 153.2. There is no configuration workaround that mitigates renderer-level memory corruption or a site isolation defect — patching is the only fix. Prioritize internet-facing knowledge workers, executives, finance, and anyone whose role involves opening unsolicited links or external email.
2. Audit ESR deployments specifically. CVE-2026-84143 spans Thunderbird 154, ESR 153.1, and ESR 140.14 — if your org standardized on the ESR 140 train, you must migrate forward; there is no 140.x fix in this release. Do not assume "we're on ESR" equals "we're covered."
3. Force update checks and kill stale processes. Firefox's background updater helps, but users who never restart the browser stay vulnerable. Push restarts through your endpoint management tooling and verify with the inventory script and KQL exposure query above.
4. Harden Thunderbird while patching rolls out. Disable remote content loading in messages (Settings → Privacy → block remote content) and consider plain-text rendering for HTML mail as a temporary compensating control — this reduces the auto-render attack surface for CVE-2026-84141-class image parsing bugs delivered via email.
5. Enable crash telemetry aggregation. A spike in Firefox/Thunderbird renderer crashes across endpoints is a meaningful early-warning signal for exploit attempts (successful or failed) against memory corruption bugs. Pipe crash reporter data into your SIEM.
6. Monitor for CISA KEV addition. These CVEs are not in KEV as of this writing. Given the CVSS 9.8 network-vector scores, if exploitation emerges, KEV listing with a federal remediation deadline (typically 21 days, often shorter for browsers) will follow fast — pre-stage your patch pipeline so a KEV-driven emergency is a non-event.
7. Hunt retroactively. Run the child-process and crash-clustering hunts across the last 14–30 days on any host that was running a vulnerable build, prioritizing hosts of high-value users. Internally discovered bugs carry no exploitation guarantee — but patch-diffing starts the moment the advisory drops.

References:

• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-84140 (and /CVE-2026-84141, /CVE-2026-84142, /CVE-2026-84143)
• Mozilla Security Advisories: https://www.mozilla.org/en-US/security/advisories/
• CISA KEV Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog

The bottom line: four 9.8s on the two pieces of software your users point at untrusted content all day, every day. Patch the browsers and mail clients first, hunt for post-exploitation behavior second, and treat any renderer crash spike on high-value endpoints as a ticket worth opening.

Related Resources

Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub