Use-after-free in the JavaScript: GC component. (CVE-2026-84118)

CVE-2026-84118 is a use-after-free vulnerability (CWE-416) found in the JavaScript garbage collection component of Firefox. This flaw could lead to memory corruption affecting confidentiality and integrity with user interaction required. Mozilla fixed this vulnerability in Firefox 155 and Firefox ESR 153.2. The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N, scoring 5.4 (medium severity). No active exploitation has been observed. The Mozilla advisories MFSA 2026-82 and MFSA 2026-85 provide detailed information and confirm the fix in the stated versions.

The vulnerability allows an attacker to exploit a use-after-free condition in Firefox's JavaScript garbage collector, potentially leading to limited confidentiality and integrity impacts. Exploitation requires user interaction but no privileges or elevated access. There are no reports of known exploits in the wild. The impact is rated medium severity with a CVSS score of 5.4.

This vulnerability is fixed in Firefox 155 and Firefox ESR 153.2. Users and administrators should update to these versions or later to remediate the issue. Since the vendor advisory confirms the fix, no additional mitigation steps are required beyond applying the official updates.