Use After Free in Mozilla products - CVE-2026-4691

Detailed vulnerability description

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to use-after-free in the CSS Parsing and Computation component when processing CSS content. A remote attacker can trick the victim into visiting a specially crafted website and execute arbitrary code.

Exploitation could result in memory corruption and arbitrary code execution in the context of the browser.

How to mitigate CVE-2026-4691

Sources

• https://www.mozilla.org/en-US/security/advisories/mfsa2026-21/
• https://www.mozilla.org/en-US/security/advisories/mfsa2026-22/
• https://www.mozilla.org/en-US/security/advisories/mfsa2026-20/
• https://bugzilla.mozilla.org/show_bug.cgi?id=2017512