{"id":"CVE-2026-117867","kind":"vulnerability","aliases":["CVE-2026-117867"],"related":[],"title":"Firefox: use-after-free in Layout component can crash or run code","description":"Use-after-free in the Layout component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, and Firefox ESR 153.6.","summary":"Firefox's Layout component has a use-after-free bug, where memory is used after it has been released. The sources do not say what an attacker can gain beyond that, but memory corruption like this can be used to crash the browser or run attacker code.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["browsers","desktop","firefox","runtime"],"not_affected_if":["already-on-fixed-version"],"how_to_check":"- Run `firefox --version` and compare against the fixed releases `159`, `115.44` and `153.6` (ESR)\n- Check the Help > About Firefox page for the installed version","fix":"- Update Firefox to `159` or later\n- Update Firefox ESR to `115.44` or `153.6`","status":"open","published_at":"2026-10-27T14:16:41+00:00","first_seen_at":"2026-10-27T14:32:21+00:00","triaged_at":"2026-10-27T14:39:18+00:00","updated_at":"2026-10-27T14:39:18+00:00","category":"runtime","confidence":0.5,"triage":{"at":"2026-10-27T14:39:18Z","model":"claude-haiku-5-5","output":{"fix":"- Update Firefox to `159` or later\n- Update Firefox ESR to `115.44` or `153.6`","reach":"internet","title":"Firefox: use-after-free in Layout component can crash or run code","impact":"high","summary":"Firefox's Layout component has a use-after-free bug, where memory is used after it has been released. The sources do not say what an attacker can gain beyond that, but memory corruption like this can be used to crash the browser or run attacker code.","category":"runtime","nicknames":[],"who_cares":["firefox","desktop","browsers"],"confidence":0.5,"needs_auth":"no","worst_case":"unknown; memory corruption may allow code execution","analyst_note":"Check the Mozilla security advisory for this CVE for the affected version range, severity and whether it is exploited in the wild.","how_to_check":"- Run `firefox --version` and compare against the fixed releases `159`, `115.44` and `153.6` (ESR)\n- Check the Help > About Firefox page for the installed version","needs_analyst":true,"not_affected_if":["already-on-fixed-version"],"who_is_affected":"Anyone running a Firefox build older than the fixed releases, on any branch they use (current, ESR 115, or ESR 153). Managed fleets that pin Firefox ESR should check which branch they are on. The sources do not say which versions were affected, so the exact affected range is unknown.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000584,"input_tokens":3240,"output_tokens":521,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-117867':16A,19A '-2026':15A,18A '115.44':89C '153.6':93C '159':86C 'attack':51B,70B 'beyond':54B 'browser':20B,67B 'bug':34B 'code':13A,71B 'compon':8A,27B,79C 'corrupt':58B 'crash':10A,65B 'cve':14A,17A 'desktop':21B 'esr':88C,92C 'firefox':1A,22B,24B,85C,87C,91C 'fix':83C 'free':5A,33B,75C 'gain':53B 'layout':7A,26B,78C 'like':59B 'memori':36B,57B 'releas':43B 'run':12A,69B 'runtim':23B 'say':48B 'sourc':45B 'use':3A,31B,38B,63B,73C 'use-after-fre':2A,30B,72C 'vulner':81C","nicknames":[],"mitigations":[],"who_affected":"Anyone running a Firefox build older than the fixed releases, on any branch they use (current, ESR 115, or ESR 153). Managed fleets that pin Firefox ESR should check which branch they are on. The sources do not say which versions were affected, so the exact affected range is unknown.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-27T14:16:41+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-117867","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117867","severity":null,"published_at":"2026-10-27T14:16:41+00:00","modified_at":"2026-10-27T14:16:41+00:00","first_seen_at":"2026-10-27T14:32:21+00:00","fetched_at":"2026-10-27T14:32:21+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}