Firefox’s September update: use-after-free bugs and sandbox escapes

Mozilla describes CVE-2026-84119 as both a use-after-free and a sandbox escape. Those terms describe the defect and its consequence, respectively. The September releases also cover multiple Firefox branches, so administrators need to match the advisory to the channel actually installed.

The September 1 disclosures

Mozilla’s Firefox 155 advisory lists CVE-2026-84119 as a use-after-free issue in DOM Navigation with a sandbox-escape impact. It credits Yaqoub Aldurayhim. The advisory also includes CVE-2026-84143, an internally discovered group of security defects fixed across Firefox 155, ESR 153.2 and ESR 140.15. Mozilla describes possible exploitation of those internal defects; that wording is not a report of an observed attack campaign.

Mozilla’s Firefox 155 security advisory

The ESR 153.2 advisory independently lists CVE-2026-84119. ESR 140.15 has its own advisory and affected-issue list; do not assume that every issue in the rapid-release advisory appears in every ESR branch.

Mozilla’s Firefox ESR 153.2 advisory

Mozilla’s Firefox ESR 140.15 advisory

When code keeps using an object that is gone

Native software allocates storage for an object and releases it when the object is no longer needed. A use-after-free occurs when some code keeps using a reference after that lifetime has ended. The memory may now hold something else. The first symptom can be a crash, but the underlying problem is a broken agreement about ownership and lifetime.

MITRE’s definition of use-after-free, CWE-416

Navigation, callbacks and cooperating browser components make that agreement difficult to maintain. Each needs to know when the objects it uses remain valid. Mozilla’s entry identifies the lifetime problem, but does not publish the callback sequence, object layout or exact transition responsible for this CVE.

What the sandbox-escape description adds

Isolation limits what code processing untrusted content can affect. A sandbox escape crosses one of those intended restrictions. The memory-lifetime defect describes how code goes wrong; the escape describes a possible consequence. Both labels can apply to the same vulnerability.

The advisory does not establish kernel compromise, persistence or access to every account. Those outcomes would need further evidence. The escape remains serious within its documented scope, and keeping isolation in place is no substitute for correcting the memory bug.

Check the installed Firefox channel

Extended Support Release keeps major feature changes on a longer schedule than rapid-release Firefox, while continuing to receive maintenance and security fixes. ESR still needs its branch’s patch updates.

Mozilla’s explanation of Firefox update channels

Record the operating system, channel, full version and update owner, then use the advisory for that branch. A maintained ESR release beginning with 140 is not automatically stale because the rapid-release version begins with 155. Equally, the word ESR in an inventory does not prove the current patch is installed.

For a browser updated directly by Mozilla, the About Firefox workflow checks for updates and prompts for a restart when needed. Distribution-managed and centrally managed installations should follow their applicable management process. Save work, complete the update and verify the running version afterward.

Mozilla’s Firefox update instructions

After updating, check the running version, a routine business application and required extensions. Assign an owner to any compatibility failure and work toward a supported solution for that workflow. Leaving the browser frozen or weakening its isolation creates a longer-lived security problem.

Source check: September 8, 2026. The vulnerability findings below are Mozilla’s and its credited researchers’ work. Short Circuit LLC provides the architectural explanation and defensive analysis.