External risk intelligence

Mozilla Firefox and Thunderbird Profile Backup Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-84134

This vulnerability affects the Profile Backup component of desktop client applications (Firefox and Thunderbird). These components are local to the user's machine and are not exposed as internet-facing services, APIs, or gateways.

Information Disclosure

Mozilla Firefox

before 153.2.0154.0.0 to before 155.0.0154.0 to before 155.0

Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in the Profile Backup component of Mozilla Firefox and Thunderbird. This issue allows for unauthorized access to sensitive information and could potentially lead to the compromise of user data. The main concern is confirming the relevance and exposure of this vulnerability within our environment.

Information disclosure in profile backups.
Affects user data; confirm relevance.
Ensure all affected software is updated.

Attack Path

How an attacker could exploit the issue

An attacker could reach this vulnerability through the Profile Backup component. The vulnerability can lead to a complete system compromise if exploited.

No special access required.
Vulnerable component is Profile Backup.
Risk of complete system compromise.

Live Threat

Current exploitation, exposure, and threat context

When supported by the advisory, this vulnerability in the Profile Backup component could allow an attacker to access sensitive profile data. The advisory indicates that this vulnerability is not exposed as an internet-facing service.

Profile backup data at risk.
Exposed through a network.
Complete system compromise possible.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability affects the Profile Backup component in Firefox and Thunderbird. The first practical step is to identify all installations of these applications, determine their reachability and business criticality, and confirm the accountable owner for each. Subsequently, a remediation plan should be developed based on the assessed risk.

Own the issue via application teams.
Verify affected application installations.
Plan remediation for critical assets.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Profile Backup component in Firefox and Thunderbird?

This component is a built-in feature designed to manage and secure user profile data, such as bookmarks, passwords, and history. It periodically saves or exports these settings to help users recover their information. Because it interacts directly with your local user data files, it is a critical piece of the application's internal architecture for maintaining personal browser and email configurations.

What does CWE-200 mean for CVE-2026-84134?

CWE-200 refers to an Exposure of Sensitive Information to an Unauthorized Actor. In the context of this CVE, it means that the Profile Backup component has a flaw that could allow an unauthorized party to access or view information that should remain private. Instead of keeping your data strictly contained within your profile, the vulnerability creates a path where that information could be leaked or accessed improperly.

How is this Profile Backup vulnerability triggered?

The issue is tied to the way the software handles backup data, meaning an attacker would likely need to interact with the mechanism responsible for creating or accessing these backups. Importantly, simply using the browser or email client for standard web browsing or messaging does not inherently trigger the bug. The vulnerability requires specific interaction with the backup functionality rather than being an automatic consequence of normal software use.

Do I need to worry about this if I use Firefox or Thunderbird?

Whether you need to prioritize this depends on your specific environment. According to Halo Surface Signal, this vulnerability affects local components within desktop applications rather than internet-facing services like web servers or APIs. Because the Profile Backup component is generally restricted to the local machine, it is unlikely to be reachable by remote attackers over the internet, which typically lowers the urgency compared to network-exposed services.

How should I respond to this vulnerability?

The most effective first step is to locate all installations of Firefox and Thunderbird within your organization to understand where this software is running. Once identified, ensure that these applications are updated to the corrected versions—specifically Firefox 155, Firefox ESR 153.2, Thunderbird 155, or Thunderbird 153.2. Coordinating with application owners to track these updates will ensure your environment is protected against the risks associated with this flaw.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.