Live › vulnerability › CVE-2026-117895
Go to dashboardA use-after-free bug in the DOM Core and HTML component of Firefox was fixed in Firefox 159 and ESR 115.44 and 153.6. Memory reuse after free can let a crafted web page corrupt memory and may allow code execution, though the sources do not state the impact.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-27 14:32 UTC. All times on this page are UTC.
Anyone running an affected Firefox build who browses untrusted web content is potentially exposed, since the bug sits in the DOM code that handles pages. Teams whose machines run only fixed or newer builds can skip it. The sources do not say whether exploitation requires any particular browser setting.
No product ranges from the sources yet.
firefox --version (or check About Firefox) and compare against 159, 115.44 and 153.6159 or later on the current branch115.44 or later on the 115 line153.6 or later on the 153 lineEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, and Firefox ESR 153.6.
This page as .md · .json · in your agent: get_signal("CVE-2026-117895")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.