Live › vulnerability › CVE-2026-117867
Go to dashboardFirefox's Layout component has a use-after-free bug, where memory is used after it has been released. The sources do not say what an attacker can gain beyond that, but memory corruption like this can be used to crash the browser or run attacker code.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-27 14:32 UTC. All times on this page are UTC.
Anyone running a Firefox build older than the fixed releases, on any branch they use (current, ESR 115, or ESR 153). Managed fleets that pin Firefox ESR should check which branch they are on. The sources do not say which versions were affected, so the exact affected range is unknown.
No product ranges from the sources yet.
firefox --version and compare against the fixed releases 159, 115.44 and 153.6 (ESR)159 or later115.44 or 153.6Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Use-after-free in the Layout component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, and Firefox ESR 153.6.
This page as .md · .json · in your agent: get_signal("CVE-2026-117867")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.