Use-after-free in the DOM: Core & HTML component. (CVE-2026-84125)

CVE-2026-84125 is a use-after-free vulnerability affecting the DOM Core & HTML component in Firefox. Use-after-free bugs occur when a program continues to use a pointer after the memory it points to has been freed, potentially leading to memory corruption or security issues. This vulnerability was identified and fixed by Mozilla in Firefox 155 and Firefox ESR 153.2. The CVSS 3.1 vector indicates the vulnerability is remotely exploitable without privileges, requires user interaction, and impacts confidentiality and integrity to a limited extent. Mozilla’s security advisories confirm the fix and classify the impact as high for this and related vulnerabilities, though the CVSS score here is moderate.

The vulnerability could allow an attacker to cause limited unauthorized disclosure or modification of information within the affected Firefox browser. There is no impact on availability. No active exploitation in the wild has been reported. The vulnerability is considered moderate in severity based on CVSS 3.1 scoring and Mozilla’s assessment.

This vulnerability has been officially fixed by Mozilla in Firefox 155 and Firefox ESR 153.2. Users and administrators should update affected Firefox installations to these versions or later to remediate the issue. No additional mitigation actions are required beyond applying the official update.