by Kastro
Paper/Archive/CVE-2026-0884

CVE-2026-0884

Mozilla Firefox — Use-after-free in the JavaScript Engine component

EPSS 0.5%CVSS 9.8
critical.is priorityof 100
37
CVSS 9.8 (ADP)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 40.2.402 × 208.0No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Use-after-free in the JavaScript Engine component. This vulnerability was fixed in Firefox 147, Firefox ESR 140.7, Thunderbird 147, and Thunderbird 140.7.

Affected

ProductAffectedFixed inSource
Firefoxsee advisory140.7CNA
Thunderbirdsee advisory140.7CNA

Scores by source

CISA ADP9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refbugzilla.mozilla.org/show_bug.cgi?id=2003588refmozilla.org/security/advisories/mfsa2026-01refmozilla.org/security/advisories/mfsa2026-03refmozilla.org/security/advisories/mfsa2026-04refmozilla.org/security/advisories/mfsa2026-05