CVE-2026-84128 in Firefox
Summary
by MITRE • 09/01/2026
Privilege escalation in the WebDriver BiDi component. This vulnerability was fixed in Firefox 155.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/01/2026
The discovery of a privilege escalation flaw within the WebDriver BiDi (Bi-directional) component represents a significant security concern for automated browser testing and remote control environments. The WebDriver protocol, standardized by W3C, serves as the primary interface for controlling web browsers programmatically, allowing external applications to interact with page elements, navigate URLs, and execute scripts. The introduction of the BiDi extension was designed to enhance this interaction model by enabling real-time communication between the client and the browser through a persistent connection, typically over WebSocket or similar transport mechanisms. This architecture allows for more responsive automation workflows but also expands the attack surface if not implemented with rigorous security boundaries. In the specific instance addressed in Firefox version 155, the vulnerability stemmed from an insufficient validation of command permissions within this bi-directional channel.
The technical core of the flaw lies in how the browser handled authorization checks when processing commands sent via the BiDi interface. Under normal operational parameters, a WebDriver session is bound to a specific context and user privilege level, ensuring that automated scripts cannot perform actions reserved for higher-privileged users or system-level operations. However, due to a logic error in the permission enforcement mechanism of the BiDi component, an attacker who had gained control over a lower-privilege WebDriver session could craft malicious commands that bypassed these restrictions. By exploiting this gap, it was possible to escalate privileges from a standard user context to one with elevated capabilities, potentially allowing access to sensitive browser data or system resources that should have remained isolated. This type of vulnerability is classically categorized under CWE-269, which addresses Improper Privilege Management, specifically where the software does not properly assign and manage security-critical execution privileges.
The operational impact of such a privilege escalation can be severe depending on the deployment context. In automated testing pipelines or continuous integration environments, WebDriver sessions often run with varying levels of trust. If an attacker compromises a test script or injects malicious code into an automation workflow, they could leverage this flaw to extract cookies, local storage data, or session tokens from other tabs or windows that were previously inaccessible. Furthermore, in scenarios where the browser is used for sensitive operations such as banking or corporate logins, successful exploitation could lead to account takeover or unauthorized access to internal systems. The ability to escalate privileges effectively breaks the isolation model of the web application sandbox, allowing malicious actors to pivot from a confined automation context into broader system interactions. This aligns with ATT&CK technique T1059, Command and Scripting Interpreter, as it enables an attacker to execute commands within the browser environment that exceed their intended scope, potentially leading further down the kill chain toward data exfiltration or lateral movement in enterprise networks.
Mitigation for this vulnerability primarily relies on applying the vendor-provided patch included in Firefox 155. Organizations and developers utilizing automated testing frameworks must ensure that all instances of the affected browser are updated to this version or later to close the permission validation gap. Beyond immediate patching, security teams should review their automation configurations to minimize the privileges granted to WebDriver sessions. Implementing strict origin isolation policies and ensuring that test environments do not share sensitive session data with production contexts can reduce the blast radius if a similar vulnerability were to emerge in the future. Additionally, monitoring for anomalous behavior from automated processes, such as unexpected network connections or unusual command sequences via WebSocket endpoints, can provide an additional layer of defense against exploitation attempts targeting browser automation components.