EUVD-2026-14837
GHSA-9979-85jw-xp9m
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
4Description
Use-after-free in the Widget: Cocoa component. This vulnerability affects Firefox < 149 and Firefox ESR < 140.9.
Analysis
A use-after-free vulnerability in Firefox's Cocoa widget component allows remote code execution without user interaction or special privileges, affecting Firefox versions below 149 and ESR below 140.9. An attacker can exploit this memory corruption flaw over the network to achieve complete system compromise with high confidentiality, integrity, and availability impact. …
Sign in for full analysis, threat intelligence, and remediation guidance.
Remediation
Within 24 hours: Identify all affected systems and apply vendor patches immediately. If patching is delayed, consider network segmentation to limit exposure.
Sign in for detailed remediation steps.
Priority Score
Vendor Status
Debian
| Release | Status | Fixed Version | Urgency |
|---|---|---|---|
| sid | vulnerable | 148.0.2-1 | - |
| (unstable) | fixed | (unfixed) | - |
| Release | Status | Fixed Version | Urgency |
|---|---|---|---|
| bullseye | vulnerable | 115.14.0esr-1~deb11u1 | - |
| bullseye (security) | vulnerable | 140.8.0esr-1~deb11u1 | - |
| bookworm | vulnerable | 128.14.0esr-1~deb12u1 | - |
| bookworm (security) | vulnerable | 140.8.0esr-1~deb12u1 | - |
| trixie (security), trixie | vulnerable | 140.8.0esr-1~deb13u1 | - |
| forky, sid | vulnerable | 140.8.0esr-1 | - |
| (unstable) | fixed | (unfixed) | - |
Share
External POC / Exploit Code
Leaving vuln.today