{"id":"CVE-2026-117878","kind":"vulnerability","aliases":["CVE-2026-117878"],"related":[],"title":"Firefox: use-after-free in IndexedDB storage fixed in 159","description":"Other issue, use-after-free in the Storage: IndexedDB component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, and Firefox ESR 153.6.","summary":"Firefox has a use-after-free bug in its IndexedDB storage component, where memory is used after being freed. The sources do not say what an attacker can achieve with it, such as code execution or only a crash.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["desktop-browsers","firefox","firefox-esr","runtime"],"not_affected_if":["fixed-version"],"how_to_check":"- Check the installed Firefox version in the About Firefox dialog or with `firefox --version`\n- Compare against the fixed versions: Firefox `159`, Firefox ESR `115.44`, Firefox ESR `153.6`","fix":"- Update Firefox to `159` or later\n- Update Firefox ESR to `115.44` or `153.6` or later, matching the ESR branch in use","status":"open","published_at":"2026-10-27T14:16:43+00:00","first_seen_at":"2026-10-27T14:32:21+00:00","triaged_at":"2026-10-27T14:39:06+00:00","updated_at":"2026-10-27T14:39:06+00:00","category":"runtime","confidence":0.4,"triage":{"at":"2026-10-27T14:39:06Z","model":"claude-haiku-5-5","output":{"fix":"- Update Firefox to `159` or later\n- Update Firefox ESR to `115.44` or `153.6` or later, matching the ESR branch in use","reach":"internet","title":"Firefox: use-after-free in IndexedDB storage fixed in 159","impact":"medium","summary":"Firefox has a use-after-free bug in its IndexedDB storage component, where memory is used after being freed. The sources do not say what an attacker can achieve with it, such as code execution or only a crash.","category":"runtime","nicknames":[],"who_cares":["firefox","firefox-esr","desktop-browsers"],"confidence":0.4,"needs_auth":"unknown","worst_case":"unknown; the sources do not say what an attacker gets","analyst_note":"Find the Mozilla security advisory for the Firefox 159 and ESR fixes to confirm the CVE's impact, trigger conditions, and whether it is exploitable beyond a crash.","how_to_check":"- Check the installed Firefox version in the About Firefox dialog or with `firefox --version`\n- Compare against the fixed versions: Firefox `159`, Firefox ESR `115.44`, Firefox ESR `153.6`","needs_analyst":true,"not_affected_if":["fixed-version"],"who_is_affected":"Any browser install of Firefox or Firefox ESR on an affected version, since IndexedDB is part of the browser's storage layer. The sources do not say whether specific content or site settings are needed to trigger it. Systems on a fixed version can skip it.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.00061,"input_tokens":3262,"output_tokens":567,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-117878':14A,17A '-2026':13A,16A '115.44':86C '153.6':90C '159':11A,83C 'achiev':55B 'attack':53B 'browser':20B 'bug':33B 'code':60B 'compon':38B,76C 'crash':65B 'cve':12A,15A 'desktop':19B 'desktop-brows':18B 'esr':24B,85C,89C 'execut':61B 'firefox':1A,21B,23B,26B,82C,84C,88C 'firefox-esr':22B 'fix':9A,80C 'free':5A,32B,71C 'freed':45B 'indexeddb':7A,36B,75C 'issu':67C 'memori':40B 'runtim':25B 'say':50B 'sourc':47B 'storag':8A,37B,74C 'use':3A,30B,42B,69C 'use-after-fre':2A,29B,68C 'vulner':78C","nicknames":[],"mitigations":[],"who_affected":"Any browser install of Firefox or Firefox ESR on an affected version, since IndexedDB is part of the browser's storage layer. The sources do not say whether specific content or site settings are needed to trigger it. Systems on a fixed version can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-27T14:16:43+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-117878","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117878","severity":null,"published_at":"2026-10-27T14:16:43+00:00","modified_at":"2026-10-27T14:16:43+00:00","first_seen_at":"2026-10-27T14:32:21+00:00","fetched_at":"2026-10-27T14:32:21+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}