Live › vulnerability › CVE-2026-117887
Go to dashboardA use-after-free bug in the DOM Core and HTML component of Firefox was fixed in Firefox 159 and the ESR releases 115.44 and 153.6. Use-after-free flaws in browser engines are commonly abused to corrupt memory and may let a malicious web page execute code, but the sources do not say how it is triggered.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-27 14:32 UTC. All times on this page are UTC.
Anyone running a Firefox build older than the fixed versions, including desktop installs and managed fleets pinned to ESR. The sources do not describe the exact page or content needed to trigger it. Systems already on the fixed versions are not affected.
No product ranges from the sources yet.
firefox --version (or check About Firefox) and compare against 159, 115.44 and 153.6.115.44 or 153.6 for ESR installs.159 or later.115.44 or later.153.6 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, and Firefox ESR 153.6.
This page as .md · .json · in your agent: get_signal("CVE-2026-117887")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.