{"id":"CVE-2026-117872","kind":"vulnerability","aliases":["CVE-2026-117872"],"related":[],"title":"Firefox: use-after-free in JavaScript standard library can be exploited","description":"Use-after-free in the JavaScript: Standard Library component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, and Firefox ESR 153.6.","summary":"A use-after-free bug in the JavaScript Standard Library component of Firefox frees memory that is still referenced, which can corrupt memory. The sources do not say what an attacker can achieve beyond that, such as code execution.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["browsers","desktop","firefox","runtime"],"not_affected_if":["up-to-date-firefox"],"how_to_check":"- Run `firefox --version` (or check Help > About Firefox) and compare against the fixed releases listed below\n- unknown for ESR installs beyond the listed versions","fix":"- Update Firefox to `159` or later\n- Update Firefox ESR 115 to `115.44` or later\n- Update Firefox ESR 153 to `153.6` or later","status":"open","published_at":"2026-10-27T14:16:41+00:00","first_seen_at":"2026-10-27T14:32:21+00:00","triaged_at":"2026-10-27T14:39:15+00:00","updated_at":"2026-10-27T14:39:15+00:00","category":"runtime","confidence":0.5,"triage":{"at":"2026-10-27T14:39:15Z","model":"claude-haiku-5-5","output":{"fix":"- Update Firefox to `159` or later\n- Update Firefox ESR 115 to `115.44` or later\n- Update Firefox ESR 153 to `153.6` or later","reach":"unknown","title":"Firefox: use-after-free in JavaScript standard library can be exploited","impact":"high","summary":"A use-after-free bug in the JavaScript Standard Library component of Firefox frees memory that is still referenced, which can corrupt memory. The sources do not say what an attacker can achieve beyond that, such as code execution.","category":"runtime","nicknames":[],"who_cares":["firefox","desktop","browsers"],"confidence":0.5,"needs_auth":"unknown","worst_case":"unknown; memory corruption in the browser JavaScript engine","analyst_note":"Check the Mozilla security advisory for this CVE to confirm exploitability, trigger conditions and whether it is reachable from web content.","how_to_check":"- Run `firefox --version` (or check Help > About Firefox) and compare against the fixed releases listed below\n- unknown for ESR installs beyond the listed versions","needs_analyst":true,"not_affected_if":["up-to-date-firefox"],"who_is_affected":"Anyone running Firefox or Firefox ESR builds older than the fixed versions, on desktop or in managed fleets that pin ESR releases. Teams that do not run Firefox in their environment can skip it. Whether a web page can trigger the flaw without user action is unknown from the sources.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000603,"input_tokens":3256,"output_tokens":555,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-117872':15A,18A '-2026':14A,17A '115.44':82C '153.6':86C '159':79C 'achiev':56B 'attack':54B 'beyond':57B 'browser':19B 'bug':28B 'code':61B 'compon':34B,72C 'corrupt':45B 'cve':13A,16A 'desktop':20B 'esr':81C,85C 'execut':62B 'exploit':12A 'firefox':1A,21B,36B,78C,80C,84C 'fix':76C 'free':5A,27B,37B,66C 'javascript':7A,31B,69C 'librari':9A,33B,71C 'memori':38B,46B 'referenc':42B 'runtim':22B 'say':51B 'sourc':48B 'standard':8A,32B,70C 'still':41B 'use':3A,25B,64C 'use-after-fre':2A,24B,63C 'vulner':74C","nicknames":[],"mitigations":[],"who_affected":"Anyone running Firefox or Firefox ESR builds older than the fixed versions, on desktop or in managed fleets that pin ESR releases. Teams that do not run Firefox in their environment can skip it. Whether a web page can trigger the flaw without user action is unknown from the sources.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-27T14:16:41+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-117872","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117872","severity":null,"published_at":"2026-10-27T14:16:41+00:00","modified_at":"2026-10-27T14:16:41+00:00","first_seen_at":"2026-10-27T14:32:21+00:00","fetched_at":"2026-10-27T14:32:21+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}