{"id":"CVE-2026-117881","kind":"vulnerability","aliases":["CVE-2026-117881"],"related":[],"title":"Firefox: use-after-free in DOM core lets a page run code","description":"Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, and Firefox ESR 153.6.","summary":"A use-after-free bug in the DOM Core and HTML component of Firefox can be triggered by web content. Fixed in Firefox 159 and Firefox ESR 115.44 and 153.6; the sources do not state the exact impact beyond the memory corruption class.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["browsers","desktop","firefox","package"],"not_affected_if":["already-on-fixed-version"],"how_to_check":"- Check the installed Firefox version in About Firefox or with `firefox --version`\n- Compare against `159`, `115.44` (ESR) and `153.6` (ESR)\n- unknown for anything beyond version checks","fix":"- Update Firefox to `159` or later\n- Update Firefox ESR to `115.44` or `153.6`\n- unknown for any other mitigation","status":"open","published_at":"2026-10-27T14:16:43+00:00","first_seen_at":"2026-10-27T14:32:21+00:00","triaged_at":"2026-10-27T14:37:58+00:00","updated_at":"2026-10-27T14:37:58+00:00","category":"package","confidence":0.4,"triage":{"at":"2026-10-27T14:37:58Z","model":"claude-haiku-5-5","output":{"fix":"- Update Firefox to `159` or later\n- Update Firefox ESR to `115.44` or `153.6`\n- unknown for any other mitigation","reach":"internet","title":"Firefox: use-after-free in DOM core lets a page run code","impact":"high","summary":"A use-after-free bug in the DOM Core and HTML component of Firefox can be triggered by web content. Fixed in Firefox 159 and Firefox ESR 115.44 and 153.6; the sources do not state the exact impact beyond the memory corruption class.","category":"package","nicknames":[],"who_cares":["firefox","desktop","browsers"],"confidence":0.4,"needs_auth":"unknown","worst_case":"unknown; memory corruption in browser content process","analyst_note":"Check the Mozilla security advisory for this CVE to confirm the impact, exploitation conditions and whether user interaction is needed.","how_to_check":"- Check the installed Firefox version in About Firefox or with `firefox --version`\n- Compare against `159`, `115.44` (ESR) and `153.6` (ESR)\n- unknown for anything beyond version checks","needs_analyst":true,"not_affected_if":["already-on-fixed-version"],"who_is_affected":"Anyone running a Firefox release or ESR line older than the fixed versions, on desktop or Android where Firefox is installed. Teams that only serve content and never browse with Firefox are not exposed through this component. The sources do not say which configurations are specifically affected.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000603,"input_tokens":3254,"output_tokens":556,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-117881':16A,19A '-2026':15A,18A '115.44':52B,87C '153.6':54B,91C '159':48B,84C 'beyond':63B 'browser':20B 'bug':29B 'class':67B 'code':13A 'compon':36B,77C 'content':44B 'core':8A,33B,75C 'corrupt':66B 'cve':14A,17A 'desktop':21B 'dom':7A,32B,74C 'esr':51B,86C,90C 'exact':61B 'firefox':1A,22B,38B,47B,50B,83C,85C,89C 'fix':45B,81C 'free':5A,28B,71C 'html':35B,76C 'impact':62B 'let':9A 'memori':65B 'packag':23B 'page':11A 'run':12A 'sourc':56B 'state':59B 'trigger':41B 'use':3A,26B,69C 'use-after-fre':2A,25B,68C 'vulner':79C 'web':43B","nicknames":[],"mitigations":[],"who_affected":"Anyone running a Firefox release or ESR line older than the fixed versions, on desktop or Android where Firefox is installed. Teams that only serve content and never browse with Firefox are not exposed through this component. The sources do not say which configurations are specifically affected.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-27T14:16:43+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-117881","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117881","severity":null,"published_at":"2026-10-27T14:16:43+00:00","modified_at":"2026-10-27T14:16:43+00:00","first_seen_at":"2026-10-27T14:32:21+00:00","fetched_at":"2026-10-27T14:32:21+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}