Use-after-free in the Audio/Video component. (CVE-2026-84120)

CVE-2026-84120 is a use-after-free vulnerability (CWE-416) found in the Audio/Video component of Firefox. It was identified internally and fixed in Firefox 155 and Firefox ESR releases 115.40, 140.15, and 153.2. The vulnerability has a CVSS 3.1 score of 5.4 with vector AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N, indicating network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, and limited confidentiality and integrity impact. The Mozilla advisories MFSA 2026-82 and MFSA 2026-83 confirm the fix and classify the impact as high for the vulnerability itself, though the CVSS score is moderate. No known exploits in the wild have been reported.

The vulnerability could allow an attacker to cause use-after-free conditions in the Audio/Video component, potentially leading to limited information disclosure or integrity compromise. There is no impact on availability. The CVSS score of 5.4 reflects a moderate risk with network attack vector and user interaction required. No active exploitation has been observed.

This vulnerability has been fixed in Firefox 155 and Firefox ESR versions 115.40, 140.15, and 153.2. Users and administrators should update to these versions or later to remediate the issue. No additional mitigation steps are required as the vendor has provided an official fix.