Use-after-free in the DOM: Core & HTML component. (CVE-2026-84124)

CVE-2026-84124 is a use-after-free vulnerability affecting the DOM Core & HTML component in Firefox. This memory corruption flaw was identified internally and fixed in Firefox 155 and Firefox ESR 140.15 and 153.2. The vulnerability has a CVSS 3.1 base score of 5.4, with attack vector network, low attack complexity, no privileges required, user interaction required, unchanged scope, and limited confidentiality and integrity impacts. The Mozilla advisories confirm the fix and classify the impact as high for this and related vulnerabilities fixed in the same releases.

Successful exploitation of this use-after-free vulnerability could allow an attacker to cause limited information disclosure or integrity violations within the affected Firefox components. The vulnerability does not impact availability. Mozilla classifies the impact as high in their advisory context, but the CVSS score rates it medium severity. There are no known exploits in the wild.

This vulnerability is fixed in Firefox 155, Firefox ESR 140.15, and Firefox ESR 153.2. Users and administrators should update to these versions or later to remediate the issue. No additional mitigation actions are required as the fix is officially released and available.