CVE-2026-84119: Vulnerability in Mozilla Firefox

CVE-2026-84119 is a use-after-free vulnerability (CWE-416) in the DOM Navigation component of Mozilla Firefox that enables sandbox escape. The vulnerability was reported by Yaqoub Aldurayhim and is classified as critical with a CVSS 3.1 base score of 9.6 (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H). It was fixed in Firefox 155, Firefox ESR 115.40, 140.15, 153.2, and Thunderbird versions 155, 140.15, and 153.2. The vendor advisories confirm that this vulnerability and several other high-impact bugs were addressed in these releases. No known exploits in the wild have been reported at the time of publication.

Successful exploitation of this use-after-free vulnerability allows an attacker to escape the sandbox environment, potentially leading to full compromise of the affected system's confidentiality, integrity, and availability. The CVSS score of 9.6 reflects the critical nature of this vulnerability, with network attack vector, low attack complexity, no privileges required, user interaction required, and scope change. The impact includes high confidentiality, integrity, and availability losses.

This vulnerability has been fixed by Mozilla in Firefox 155, Firefox ESR 115.40, 140.15, 153.2, and Thunderbird versions 155, 140.15, and 153.2. Users and administrators should update to these fixed versions or later to mitigate the risk. No additional mitigation actions are indicated by the vendor advisories beyond applying these official fixes.