# CVE-2026-84127: Mozilla Firefox for Android information disclosure in WebExtensions

Source: https://junglewise.ai/threats/cve-2026-84127-mozilla-firefox-for-android-information-disclosure-in  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-01. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-84127 · Severity: medium · CVSS 4.3 · Published 2026-09-01

Firefox for Android allows browser extensions to create tabs that appear private to the user but are not actually private, exposing data leakage. Extensions can share cookies and access tab data that should be restricted, even when not granted private browsing permissions. This misleads users about their privacy protection and could expose sensitive browsing activity to untrusted extensions.

Technologies: [Mozilla Firefox for Android](https://junglewise.ai/threats/technologies/firefox-for-android), [Mozilla Firefox Mobile](https://junglewise.ai/threats/technologies/firefox-mobile). Vendors: [Mozilla](https://junglewise.ai/threats/vendors/mozilla).

## Quick answers

**Is CVE-2026-84127 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-84127 being exploited in the wild.

**How severe is CVE-2026-84127?** Medium severity, with a CVSS score of 4.3, published 1 September 2026.

**Which products and versions are affected?** Mozilla Firefox for Android before 155.

**Is there a fix for CVE-2026-84127?** A patch was published on 2026-09-01: fixed in Firefox 155 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-84127 attacked?** It is attacked with local access.

**Am I affected by CVE-2026-84127?** Check whether you run Mozilla Firefox for Android or Mozilla Firefox Mobile at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A vulnerability in the WebExtensions component of Firefox for Android causes tabs created by extensions via the tabs.create() API to be displayed as private in the UI when they are not actually private. The root cause is that Fenix's logic for opening extension tabs in the current browsing mode predates support for the "private browsing access flag" and does not properly check whether an extension has permission to access private browsing mode. When an extension without private browsing access calls tabs.create(), GeckoView creates a non-private tab but Fenix displays it as private, allowing the extension to access cookies and tab information that should be restricted. The vulnerability requires an extension to be installed; no network interaction is needed. The fix was implemented in Firefox 155 to properly validate private browsing permissions before opening tabs.

## Affected products

- Mozilla Firefox for Android before 155

## Timeline

- 2026-09-01: disclosed
- 2026-09-01: patched: fixed in Firefox 155

## References

- [https://bugzilla.mozilla.org/show_bug.cgi?id=1699444](https://bugzilla.mozilla.org/show_bug.cgi?id=1699444)
- [https://www.mozilla.org/security/advisories/mfsa2026-82/](https://www.mozilla.org/security/advisories/mfsa2026-82/)

## Related threats

- [Firefox for Android Media component unspecified issue](https://junglewise.ai/threats/cve-2026-124937-other-issue-in-the-media-component-in-firefox-for-android-this)
- [Firefox Spoofing issue in Downloads component for Android](https://junglewise.ai/threats/cve-2026-118018-spoofing-issue-in-the-downloads-component-in-firefox-for-android)
- [Firefox for Android Downloads spoofing in filename display](https://junglewise.ai/threats/cve-2026-100823-spoofing-issue-in-the-downloads-component-in-firefox-for-android)
- [Mozilla Firefox Focus for Android other issue](https://junglewise.ai/threats/cve-2026-84135-mozilla-firefox-focus-for-android-other-issue)
- [Mozilla Firefox privilege escalation in Android](https://junglewise.ai/threats/cve-2026-84117-mozilla-firefox-privilege-escalation-in-android)