CVE-2026-84125

A flaw was found in Firefox. A use-after-free vulnerability in the DOM: Core & HTML component could allow a remote attacker to execute arbitrary code.

Red Hat has classified this flaw as having an Important severity because it enables an unauthenticated remote attacker to achieve arbitrary code execution within the user's desktop session if the victim visits a maliciously crafted web page. While the consequences of code execution are severe, exploitation requires explicit user interaction to navigate to untrusted content and is constrained by standard unprivileged user permissions and browser sandboxing. Additionally, typical Red Hat Enterprise Linux server environments do not deploy graphical environments or web browsers by default, limiting the potential attack surface primarily to desktop and workstation installations.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.