CVE-2026-84134 in Firefox
Summary
by MITRE • 09/01/2026
Other issue in the Profile Backup component. This vulnerability was fixed in Firefox 155 and Firefox ESR 153.2.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 09/01/2026
The identified security flaw resides within the Profile Backup functionality of Mozilla Firefox, specifically affecting versions prior to Firefox 155 and Firefox Extended Support Release (ESR) 153.2. This component is responsible for creating automated or manual backups of user profile data, which includes critical configuration files, extension states, cookies, and potentially sensitive authentication tokens stored in plaintext within certain browser storage mechanisms. The vulnerability stems from an improper handling of file permissions or path validation during the backup creation process. In many implementations of such features, if the system fails to strictly enforce restrictive access controls on the generated backup archives or directories, it may result in a condition where unauthorized local users or processes can read, modify, or overwrite these sensitive files. This type of flaw is commonly categorized under CWE-276 Incorrect Default Permissions when the issue involves world-readable backups, or CWE-22 Path Traversal if the vulnerability allows an attacker to write backup data outside the intended directory structure through crafted input that manipulates file paths.
From a technical perspective, the operational impact of this vulnerability depends heavily on the execution context and the privilege level of the browser process. If Firefox is running with standard user privileges, the primary risk involves local information disclosure or potential integrity compromise for other users sharing the same operating system account if default permissions are too permissive. However, in environments where browsers may be configured to run with elevated privileges or when interacting with sensitive enterprise configurations, the impact escalates significantly. An attacker who gains access to the file system could potentially extract session cookies or stored credentials from these backup files, leading to unauthorized access to user accounts and services. Furthermore, if the vulnerability allows for arbitrary file write operations via path traversal, it could be leveraged to overwrite critical configuration files, thereby disrupting service availability or enabling persistent malicious configurations that survive browser restarts. This aligns with ATT&CK technique T1083 File and Directory Discovery, as an attacker would first need to locate these backup locations, followed by T1552 Unsecured Credentials if the backups contain plaintext secrets, or T1496 Resource Hijacking if used for denial of service through file corruption.
The resolution provided in Firefox 155 and ESR 153.2 addresses this issue by implementing stricter security controls within the Profile Backup module. These updates likely involve hardening the default permissions assigned to backup files, ensuring they are only accessible by the owning user account, thereby mitigating lateral movement or information leakage risks on multi-user systems. Additionally, the fix may include enhanced input validation for any parameters passed during the backup process to prevent path traversal attacks that could lead to unauthorized file modifications. For organizations relying on Firefox ESR versions, it is imperative to apply these updates immediately to close this security gap. Administrators should also review their local group policies or configuration profiles to ensure no custom settings override the new secure defaults established by the vendor patch. Regular auditing of backup directories and ensuring that sensitive data within browser profiles is encrypted at rest can provide an additional layer of defense against similar vulnerabilities in future releases, aligning with best practices for endpoint security hygiene as outlined in NIST guidelines for web application and client-side storage protection.