Live › vulnerability › CVE-2026-117881
Go to dashboardA use-after-free bug in the DOM Core and HTML component of Firefox can be triggered by web content. Fixed in Firefox 159 and Firefox ESR 115.44 and 153.6; the sources do not state the exact impact beyond the memory corruption class.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-27 14:32 UTC. All times on this page are UTC.
Anyone running a Firefox release or ESR line older than the fixed versions, on desktop or Android where Firefox is installed. Teams that only serve content and never browse with Firefox are not exposed through this component. The sources do not say which configurations are specifically affected.
No product ranges from the sources yet.
firefox --version159, 115.44 (ESR) and 153.6 (ESR)159 or later115.44 or 153.6Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, and Firefox ESR 153.6.
This page as .md · .json · in your agent: get_signal("CVE-2026-117881")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.