CVE-2026-84118

MediumCVSS 5.4

Published: 01/09/2026(UTC)Updated: 02/09/2026(UTC)Translated: 02/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.22%

12th percentile - higher than 12% of all known CVEs

Summary

Use-after-free vulnerability in the JavaScript: GC component. It was fixed in Firefox 155, Firefox ESR 153.2, Thunderbird 155, and Thunderbird 153.2.

Risk Assessment

The risk includes potential code execution or browser crash, which could lead to compromise of user data.

Recommendation

Immediately update Firefox and Thunderbird to versions that include the fix.

Other vulnerabilities in Firefox

See all

CVE-2026-92079Critical
Mitigation bypass vulnerability in the Widget: Win32 component. It was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3.
CVE-2026-92075Critical
Mitigation bypass in the Networking component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3.
CVE-2026-92071Critical
Sandbox escape vulnerability due to incorrect boundary conditions in the Widget: Win32 component. It was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3.
CVE-2026-92066Critical
Sandbox escape in the Profile Backup component of Firefox and Thunderbird. This vulnerability was fixed in Firefox 156 and Thunderbird 156.
CVE-2026-92061Critical
Incorrect boundary conditions in the Security: Process Sandboxing component. Fixed in Firefox 156 and Thunderbird 156.
CVE-2026-92057Critical
Mitigation bypass vulnerability in the Enterprise Policies component. It was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3.
CVE-2026-92051Critical
Spoofing issue due to invalid pointer in the Graphics component. Fixed in Firefox 156 and Thunderbird 156.
CVE-2026-92048Critical
Sandbox escape vulnerability due to incorrect boundary conditions in the Widget: Win32 component. It was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3.
CVE-2026-92045Critical
Sandbox escape vulnerability due to incorrect boundary conditions in the WebRTC component. It was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3.
CVE-2026-92037Critical
Incorrect boundary conditions in the DOM: Animation component. This vulnerability was fixed in Firefox 156 and Thunderbird 156.

Original NVD description (English source)

Use-after-free in the JavaScript: GC component. This vulnerability was fixed in Firefox 155, Firefox ESR 153.2, Thunderbird 155, and Thunderbird 153.2.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS