CVE-2026-84118

CVE-2026-84118 is a use-after-free (CWE-416) in the garbage collection (GC) component of the JavaScript engine in Mozilla Firefox and Thunderbird. An attacker can trigger it by getting a user to process attacker-controlled JavaScript content — for example a malicious website in Firefox or remote/malicious message content in Thunderbird — causing a heap object to be freed while still referenced during script execution. Successful exploitation yields limited impact within the affected application: the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N) scores 5.4, indicating network-based exploitation that requires user interaction, with low confidentiality and integrity impact and no availability impact. All users running Firefox versions before 155, Firefox ESR before 153.2, Thunderbird before 155, or Thunderbird on the 153.x line before 153.2 are affected. There is no confirmed in-the-wild exploitation: the flaw is not in CISA KEV and EPSS assigns a 0.2% 30-day exploitation probability, but a public proof-of-concept is available on GitHub (the PoC's title also questions the assigned severity classification).

What to do: Upgrade to Firefox 155 or later, Firefox ESR 153.2 or later, Thunderbird 155 or later, or Thunderbird 153.2 or later, and verify the running version in each product's About dialog. Until patched, reduce exposure by avoiding untrusted websites and consider disabling remote content loading in email; no workaround is specified in the advisory. Given a public PoC exists, prioritize patching even though no in-the-wild exploitation is currently confirmed.