CVE-2026-84120: Vulnerability in Mozilla Firefox

CVE-2026-84120 is a use-after-free vulnerability (CWE-416) affecting the Audio/Video component in Mozilla Firefox and Thunderbird. This type of vulnerability involves accessing memory after it has been freed, which can lead to memory corruption and potential security issues. The vulnerability was identified and fixed in Firefox 155 and corresponding ESR and Thunderbird versions. The CVSS v3.1 base score is 5.4, with vector AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N, indicating network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, and low confidentiality and integrity impacts with no availability impact. Mozilla's security advisories confirm the fix and classify the impact as high for this and related vulnerabilities, but the CVSS score here is medium.

Successful exploitation of this use-after-free vulnerability could allow an attacker to cause limited information disclosure or integrity compromise in the affected Audio/Video component. There is no indication of availability impact or privilege escalation. No active exploitation in the wild has been reported. The vulnerability requires user interaction and can be exploited remotely over the network.

The vulnerability has been fixed by Mozilla in Firefox 155, Firefox ESR 115.40, Firefox ESR 140.15, Firefox ESR 153.2, Thunderbird 155, Thunderbird 140.15, and Thunderbird 153.2. Users and administrators should update to these fixed versions or later to remediate the issue. No additional mitigation steps are indicated by the vendor advisories.