Live › vulnerability › CVE-2026-117869
Go to dashboardA use-after-free bug in the Firefox DOM Core and HTML component lets memory be reused after it is freed. The sources do not say what an attacker can get beyond that; Mozilla fixed it in Firefox 159, ESR 115.44 and ESR 153.6.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-27 14:32 UTC. All times on this page are UTC.
Anyone running Firefox or Firefox ESR builds older than the fixed versions, including desktop users and managed fleets that pin ESR. The sources do not say whether a specific configuration or site is needed to trigger it, so unknown.
No product ranges from the sources yet.
firefox --version or open the About Firefox page and compare against 159, 115.44 or 153.6115.44 or 153.6159 or later115.44 or 153.6Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, and Firefox ESR 153.6.
This page as .md · .json · in your agent: get_signal("CVE-2026-117869")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.