{"id":"CVE-2026-84118","published":"2026-09-01T12:18:48Z","modified":"2026-09-01T21:44:10Z","title":"Use-after-free in the JavaScript: GC component","vendor":"Mozilla","product":"Firefox","tier":"tail","description":{"text":"Use-after-free in the JavaScript: GC component. This vulnerability was fixed in Firefox 155, Firefox ESR 153.2, Thunderbird 155, and Thunderbird 153.2.","provenance":"source","from":"CVE.org"},"cvss":{"score":5.4,"severity":"MEDIUM","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","provenance":"source","from":"CISA ADP Vulnrichment"},"epss":{"score":0.00287,"percentile":0.21155,"provenance":"source"},"cwes":[{"id":"CWE-416","name":"Use After Free"}],"references":[{"url":"https://bugzilla.mozilla.org/show_bug.cgi?id=2057457","tags":[]},{"url":"https://www.mozilla.org/security/advisories/mfsa2026-82/","tags":[]},{"url":"https://www.mozilla.org/security/advisories/mfsa2026-85/","tags":[]},{"url":"https://www.mozilla.org/security/advisories/mfsa2026-86/","tags":[]},{"url":"https://www.mozilla.org/security/advisories/mfsa2026-88/","tags":[]}],"priority":{"score":13.0,"factors":[{"name":"EPSS percentile","points":4.23},{"name":"Public exploit code","points":5.0},{"name":"CVSS severity","points":3.78}]},"exploitSources":{"pocGithub":{"count":1,"skipped":0,"earliest":"2026-09-08","earliestUrl":"https://github.com/SneakyNachos/CVE-2026-84118-who-labeled-the-crit-as-a-high","repos":[{"name":"SneakyNachos/CVE-2026-84118-who-labeled-the-crit-as-a-high","url":"https://github.com/SneakyNachos/CVE-2026-84118-who-labeled-the-crit-as-a-high","stars":1,"created":"2026-09-08"}]},"first":{"date":"2026-09-08","source":"PoC-in-GitHub","url":"https://github.com/SneakyNachos/CVE-2026-84118-who-labeled-the-crit-as-a-high"},"provenance":"source"},"vendorSlug":"mozilla","euvd":{"id":"EUVD-2026-69070","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-class-mozilla-firefox-cwe-416"}}