CVE-2026-4701 is a critical use-after-free vulnerability (CWE-416) affecting the JavaScript Engine in Mozilla Firefox. Use-after-free bugs occur when a program continues to use memory after it has been freed, which can lead to memory corruption and arbitrary code execution. This vulnerability was addressed and fixed in Firefox 149 and Firefox ESR 140.9. The CVSS 3.1 base score is 9.8, reflecting network attack vector, low attack complexity, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability. The vendor advisory confirms the fix and lists this vulnerability among multiple memory safety bugs resolved in the same update cycle.

The vulnerability could allow remote attackers to execute arbitrary code or cause a denial of service by exploiting the use-after-free condition in the JavaScript Engine. The CVSS score of 9.8 indicates a critical impact on confidentiality, integrity, and availability. No known exploits in the wild have been reported at the time of disclosure.

Mozilla has released official fixes for this vulnerability in Firefox 149 and Firefox ESR 140.9. Users and administrators should update to these versions or later to remediate the vulnerability. Since this is not a cloud service, remediation depends on applying the vendor's official patches. Patch status is confirmed by the Mozilla security advisories linked in the vendor advisory content.