CVE-2026-4701 describes a use-after-free vulnerability in the JavaScript Engine component of Mozilla Firefox. Use-after-free issues occur when a program continues to use memory after it has been freed, potentially leading to memory corruption and arbitrary code execution. This vulnerability was fixed in Firefox 149 and Firefox ESR 140.9 as part of a security update addressing multiple memory safety bugs. The CVSS 3.1 base score is 9.8, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. The vendor advisory confirms the fix and recommends updating to the specified versions.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code remotely with no user interaction required, potentially compromising confidentiality, integrity, and availability of the affected system. The vulnerability is rated critical with a CVSS score of 9.8. However, no known exploits in the wild have been reported at the time of the advisory.

Mozilla has released official fixes for this vulnerability in Firefox 149 and Firefox ESR 140.9. Users and administrators should update affected Firefox and Thunderbird installations to these versions or later to remediate the vulnerability. Since this is not a cloud service, patching the client software is required. There are no vendor advisories indicating that no action is required or that the issue is already mitigated without patching.