CVE-2026-0884

Use-after-free in the JavaScript Engine component

Critical · published January 13, 2026

CVSS v3.1
9.8
EPSS
0%
Percentile
39.2
In the wild
Unconfirmed
What it is

🔥 A wayward pointer in the JavaScript engine could lead to chaos! This use-after-free vulnerability lets an attacker exploit memory mishaps and potentially execute harmful scripts. 🚨 Think of it like a chef who takes a busy order from the kitchen but forgets to clear a few plates. If they don't manage their space, they might accidentally serve a dish using ingredients that were just tossed aside, creating a recipe for disaster! An attacker could manipulate the browser's memory, possibly resulting in arbitrary code execution. This means they could hijack a victim's session, steal sensitive information, or even take control of the system entirely—absolutely devastating!

Put simply

Think of it like a chef who takes a busy order from the kitchen but forgets to clear a few plates. If they don't manage their space, they might accidentally serve a dish using ingredients that were just tossed aside, creating a recipe for disaster! This use-after-free vulnerability occurs when the JavaScript engine continues to reference memory that has already been freed, leading to unpredictable behavior and security risks.

What to do

An attacker could manipulate the browser's memory, possibly resulting in arbitrary code execution. This means they could hijack a victim's session, steal sensitive information, or even take control of the system entirely—absolutely devastating! Patch immediately to Firefox 147 or Firefox ESR 140.7, as well as Thunderbird 147 or Thunderbird 140.7. Regularly update your applications to ensure you're protected from similar vulnerabilities in the future! You've got this! Following these steps will help you secure your systems and keep the internet safer for everyone! 🛡️

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00463 · 39.2th percentile
Published
2026-01-13T13:30Z
EPSS history
Timeline
  • 13 JAN 13:30Z
    Use-after-free in the JavaScript Engine component
    cvelistv5