CVE-2026-84125: Vulnerability in Mozilla Firefox

This vulnerability involves a use-after-free condition in the DOM Core & HTML component of Mozilla Firefox, identified as CVE-2026-84125. Use-after-free vulnerabilities occur when a program continues to use a pointer after the memory it points to has been freed, potentially leading to memory corruption. Mozilla fixed this issue in Firefox 155 and Firefox ESR 153.2. The CVSS 3.1 base score is 5.4, indicating medium severity, with attack vector network, low attack complexity, no privileges required, user interaction required, unchanged scope, and limited confidentiality and integrity impacts. The vendor advisories (MFSA2026-82 and MFSA2026-85) list this vulnerability among multiple use-after-free bugs fixed in these releases. No active exploitation is known.

Successful exploitation of this use-after-free vulnerability could allow an attacker to cause limited information disclosure or integrity loss within the affected Firefox components. The CVSS vector indicates no privilege requirements and network attack vector, but user interaction is needed. The impact is limited to confidentiality and integrity with no availability impact. No known exploits are reported in the wild, reducing immediate risk.

Mozilla has released official fixes for this vulnerability in Firefox 155 and Firefox ESR 153.2. Users and administrators should update affected Firefox installations to these versions or later to remediate the issue. Since the vulnerability is fixed, no additional mitigation steps are required beyond applying the update.