---
id: "CVE-2026-117878"
kind: "vulnerability"
aliases: ["CVE-2026-117878"]
title: "Firefox: use-after-free in IndexedDB storage fixed in 159"
severity: "unknown"
cvss: null
epss: null
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["desktop-browsers", "firefox", "firefox-esr", "runtime"]
not_affected_if: ["fixed-version"]
published_at: "2026-10-27T14:16:43+00:00"
first_seen_at: "2026-10-27T14:32:21+00:00"
updated_at: "2026-10-27T14:39:06+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-117878", "first_seen_at": "2026-10-27T14:32:21+00:00"}]
---

# Firefox: use-after-free in IndexedDB storage fixed in 159

Firefox has a use-after-free bug in its IndexedDB storage component, where memory is used after being freed. The sources do not say what an attacker can achieve with it, such as code execution or only a crash.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Firefox version in the About Firefox dialog or with `firefox --version`
- Compare against the fixed versions: Firefox `159`, Firefox ESR `115.44`, Firefox ESR `153.6`

## Fix

- Update Firefox to `159` or later
- Update Firefox ESR to `115.44` or `153.6` or later, matching the ESR branch in use

## Timeline

- 2026-10-27T14:32:21+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-117878

## From the sources

Other issue, use-after-free in the Storage: IndexedDB component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, and Firefox ESR 153.6.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_