Use-after-free in the Audio/Video component. (CVE-2026-84122)

CVE-2026-84122 is a use-after-free vulnerability (CWE-416) in the Audio/Video component of Firefox. It was discovered internally and fixed in Firefox 155 and corresponding ESR releases 140.15 and 153.2. The vulnerability allows an attacker to potentially cause limited information disclosure or integrity issues after triggering the use-after-free condition. The CVSS 3.1 vector indicates the attack requires network access, no privileges, user interaction, and impacts confidentiality and integrity with no availability impact. Mozilla's security advisories MFSA 2026-82 and MFSA 2026-84 confirm the fix and classify the impact as high, reflecting the potential severity if exploited.

The vulnerability can lead to limited confidentiality and integrity impacts due to use-after-free memory corruption in the Audio/Video component. It requires user interaction and network access but no privileges. There are no reports of active exploitation in the wild. Successful exploitation could allow an attacker to execute unauthorized actions affecting data confidentiality and integrity within the Firefox browser environment.

This vulnerability is fixed in Firefox 155, Firefox ESR 140.15, and Firefox ESR 153.2. Users and administrators should update to these versions or later to remediate the issue. No additional mitigation actions are required as the vendor has provided an official fix.