CVE-2026-84124: Vulnerability in Mozilla Firefox

CVE-2026-84124 is a use-after-free vulnerability affecting the DOM Core & HTML component in Mozilla Firefox. This type of vulnerability can lead to memory corruption, potentially allowing an attacker to execute arbitrary code or cause a denial of service. The issue was discovered internally and reported by Hyeonjun Ahn. Mozilla fixed this vulnerability in Firefox 155 and Firefox ESR 140.15 and 153.2. The CVSS 3.1 base score is 5.4 (medium severity) with vector AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N, indicating network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, and low impact on confidentiality and integrity, with no impact on availability. There are no known exploits in the wild. The vendor advisories confirm the fix and recommend updating to the fixed versions.

The vulnerability can lead to memory corruption via a use-after-free condition in the DOM Core & HTML component, potentially allowing an attacker to execute arbitrary code or manipulate browser behavior. The impact is rated medium with limited confidentiality and integrity impact and no availability impact. Exploitation requires user interaction and network access. No active exploitation has been reported.

Mozilla has fixed this vulnerability in Firefox 155, Firefox ESR 140.15, and Firefox ESR 153.2. Users and administrators should update to these versions or later to mitigate the risk. Since the vulnerability is fixed in these releases, no further action is required beyond applying the official updates.