CVE-2026-4711 is a use-after-free vulnerability identified in the Widget: Cocoa component of Mozilla Firefox. Use-after-free bugs occur when a program continues to use a pointer after the memory it points to has been freed, potentially leading to memory corruption. This vulnerability is part of a set of memory safety issues addressed in Firefox 149 and Firefox ESR 140.9. The CVSS v3.1 base score is 9.8, indicating critical severity with network attack vector, no required privileges or user interaction, and high impact on confidentiality, integrity, and availability. Mozilla has officially fixed this vulnerability in Firefox 149 and Firefox ESR 140.9. No exploits have been reported in the wild. The vendor advisory is the authoritative source confirming the fix and impact.

The vulnerability allows an attacker to exploit a use-after-free condition in the Widget: Cocoa component, which could lead to memory corruption and potentially arbitrary code execution with the privileges of the affected application. The CVSS score of 9.8 reflects critical impact on confidentiality, integrity, and availability. However, no active exploitation has been observed in the wild. The vulnerability affects Firefox versions prior to 149 and Firefox ESR versions prior to 140.9.

Mozilla has released official fixes for CVE-2026-4711 in Firefox 149 and Firefox ESR 140.9. Users and administrators should update affected Firefox and Thunderbird installations to these versions or later to remediate this vulnerability. Since this is not a cloud service, remediation depends on applying the vendor's patches. There are no vendor advisories indicating that no action is required or that the issue is already mitigated without patching.