CVE-2026-84123: 
NixOS vulnerability analysis and mitigation

CVE-2026-84123 is a use-after-free vulnerability in the Graphics: WebGPU component of Mozilla Firefox that enables privilege escalation. It was discovered by researcher Yaqoub Aldurayhim and disclosed on September 1, 2026, affecting Firefox versions prior to 155 and Firefox ESR versions prior to 153.2. The vulnerability carries a CVSS v3.1 base score of 8.8 (High) (Mozilla Advisory mfsa2026-82, Mozilla Advisory mfsa2026-85).

The vulnerability is classified as CWE-416 (Use After Free), occurring within Firefox's Graphics: WebGPU component — the browser's implementation of the WebGPU API for GPU-accelerated graphics. A use-after-free condition arises when memory associated with a WebGPU object is freed but a dangling reference to that memory is subsequently accessed, potentially allowing an attacker to control execution flow and escalate privileges. Exploitation requires network delivery and user interaction (e.g., visiting a malicious webpage), but no prior authentication or privileges are needed. The underlying bug is tracked as Bugzilla Bug 2060047, though the report is access-restricted (Mozilla Advisory mfsa2026-82, Mozilla Advisory mfsa2026-85).

Successful exploitation results in high impact to confidentiality, integrity, and availability, as reflected in the CVSS scoring. An attacker who tricks a user into visiting a crafted webpage could escalate privileges within the browser process, potentially enabling arbitrary code execution in the context of the browser or the underlying operating system user account. This could lead to sensitive data theft, installation of malware, or further lateral movement within the victim's environment (Mozilla Advisory mfsa2026-82, Mozilla Advisory mfsa2026-85).

As of the disclosure date (September 1, 2026), no active in-the-wild exploitation has been reported, and the NVD SSVC assessment indicates exploitation is "none" and the vulnerability is not automatable. No public proof-of-concept exploit code has been identified. The EPSS score is reported as 0.0, and the vulnerability does not appear in the CISA Known Exploited Vulnerabilities catalog at this time (Mozilla Advisory mfsa2026-85).

1. Reconnaissance: Identify targets running unpatched Firefox (versions below 155) or Firefox ESR (versions below 153.2) using browser fingerprinting or social engineering.
2. Craft malicious webpage: Develop a webpage containing JavaScript that leverages the WebGPU API to trigger the use-after-free condition — for example, by creating and destroying WebGPU objects in a sequence that leaves a dangling pointer accessible.
3. Deliver payload: Host the malicious page on an attacker-controlled server and lure the victim to visit it via phishing, malvertising, or a compromised website.
4. Trigger vulnerability: When the victim's browser processes the WebGPU operations on the page, the use-after-free is triggered, corrupting memory in a controlled manner.
5. Achieve privilege escalation: Exploit the memory corruption to redirect execution flow, escalating privileges within the browser process and potentially executing arbitrary code with the permissions of the browser's OS user account (Mozilla Advisory mfsa2026-82, Mozilla Advisory mfsa2026-85).

• Network: Unexpected outbound connections from the browser process to unknown external IP addresses or domains following WebGPU-heavy page loads; unusual DNS queries initiated by the Firefox process.
• Process: Suspicious child processes spawned by the Firefox parent process (e.g., cmd.exe, powershell.exe, /bin/sh, curl, wget); Firefox process exhibiting abnormal CPU or memory usage consistent with heap exploitation.
• Logs: Browser crash reports or minidumps referencing WebGPU or GPU process components; OS-level audit logs showing privilege changes associated with the Firefox process.
• File System: Unexpected files written to user profile directories or temporary folders by the Firefox process; new persistence mechanisms (scheduled tasks, registry run keys, cron jobs) created under the browser user's account.

Mozilla has released patches addressing this vulnerability in Firefox 155 and Firefox ESR 153.2, both announced on September 1, 2026. Users and administrators should update to these versions or later immediately. No configuration-based workarounds have been published; upgrading is the only recommended remediation. Organizations managing Firefox deployments via enterprise policy should prioritize this update given the high CVSS score and privilege escalation potential (Mozilla Advisory mfsa2026-82, Mozilla Advisory mfsa2026-85).

The vulnerability was reported to Mozilla by security researcher Yaqoub Aldurayhim, who also reported several other high-severity use-after-free and sandbox escape issues addressed in the same Firefox 155 and ESR 153.2 release cycle. The September 1, 2026 advisory batch addressed a notably large number of high-severity memory safety issues, which may draw broader community attention to Firefox's WebGPU implementation security. No significant independent researcher commentary or media coverage specific to CVE-2026-84123 has been identified beyond the Mozilla advisories (Mozilla Advisory mfsa2026-82, Mozilla Advisory mfsa2026-85).