CVE-2026-84118: Vulnerability in Mozilla Firefox

CVE-2026-84118 is a use-after-free vulnerability identified in the JavaScript garbage collection (GC) component of Mozilla Firefox. This type of vulnerability (CWE-416) involves the use of memory after it has been freed, which can lead to memory corruption and potentially exploitable conditions. Mozilla fixed this vulnerability in Firefox 155 and Firefox ESR 153.2. The CVSS v3.1 base score is 5.4, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, and limited confidentiality and integrity impacts. The vendor advisories (MFSA 2026-82 and MFSA 2026-85) confirm the fix and classify the impact as high for the overall security update, though this specific CVE is rated medium severity. No known exploits have been observed in the wild.

The vulnerability could allow an attacker to execute a use-after-free condition in the JavaScript GC component, potentially leading to limited information disclosure or integrity compromise. However, there is no indication of availability impact or widespread exploitation. The CVSS score of 5.4 indicates a medium severity impact with limited confidentiality and integrity effects. No active exploitation has been reported.

Mozilla has released official fixes for this vulnerability in Firefox 155 and Firefox ESR 153.2. Users and administrators should update to these versions or later to remediate the issue. No additional mitigation actions are required beyond applying the official patches.