Red Hat CVE-2026-4723

Remote unauthenticated attacker can exploit Firefox versions below 149 through network access. Victim must visit a malicious webpage or open a crafted document. No special browser configuration or user privileges required. Affects default Firefox installations on all supported platforms.

The risk assessment is constrained by incomplete data: CVSS score, CVSS vector, EPSS score, and KEV status are all marked as unavailable or not provided. However, several factors suggest elevated priority. Use-after-free vulnerabilities in JavaScript engines are historically high-impact, often enabling information disclosure and arbitrary code execution depending on memory layout and heap feng shui techniques. The vulnerability affects a widely-deployed product (Firefox) across all versions below 149, meaning billions of users are potentially exposed until patching. The fact that Mozilla issued a full security advisory (MFSA2026-20) and assigned a CVE indicates Mozilla assessed this as significant enough for coordinated disclosure. Without CVSS vector details, attack complexity cannot be precisely determined, but JavaScript engine exploits typically require user interaction (visiting a malicious webpage) rather than network-level exploitation. The absence of a published EPSS score or KEV confirmation does not diminish the threat—it may reflect the recency of disclosure or embargoed information. Given the component's criticality and broad user base, this should be treated as a high-priority patch candidate despite the missing metrics.

An attacker crafts a malicious webpage containing specially crafted JavaScript code that triggers the use-after-free condition in Firefox's JavaScript Engine. When a user visits this page, the malicious script manipulates the heap to gain read or write access to freed memory regions, potentially exfiltrating sensitive data from the browser's memory (e.g., authentication tokens, cached credentials) or achieving arbitrary code execution with the user's privileges. No public proof-of-concept is documented in the available intelligence, but the vulnerability's presence in a widely-used, JavaScript-heavy internet environment makes widespread exploitation feasible once technical details emerge.