{"id":"CVE-2026-117895","kind":"vulnerability","aliases":["CVE-2026-117895"],"related":[],"title":"Firefox: use-after-free in DOM core and HTML lets attackers run code","description":"Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, and Firefox ESR 153.6.","summary":"A use-after-free bug in the DOM Core and HTML component of Firefox was fixed in Firefox 159 and ESR 115.44 and 153.6. Memory reuse after free can let a crafted web page corrupt memory and may allow code execution, though the sources do not state the impact.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["browsers","desktop","firefox","runtime"],"not_affected_if":["fixed-version"],"how_to_check":"- Run `firefox --version` (or check About Firefox) and compare against `159`, `115.44` and `153.6`\n- Check the ESR line in use with the Firefox ESR version shown in About Firefox\n- Check managed fleets for the Firefox version reported by the deployment tool","fix":"- Update Firefox to `159` or later on the current branch\n- Update Firefox ESR to `115.44` or later on the 115 line\n- Update Firefox ESR to `153.6` or later on the 153 line","status":"open","published_at":"2026-10-27T14:16:44+00:00","first_seen_at":"2026-10-27T14:32:22+00:00","triaged_at":"2026-10-27T14:37:44+00:00","updated_at":"2026-10-27T14:37:44+00:00","category":"runtime","confidence":0.5,"triage":{"at":"2026-10-27T14:37:44Z","model":"claude-haiku-5-5","output":{"fix":"- Update Firefox to `159` or later on the current branch\n- Update Firefox ESR to `115.44` or later on the 115 line\n- Update Firefox ESR to `153.6` or later on the 153 line","reach":"internet","title":"Firefox: use-after-free in DOM core and HTML lets attackers run code","impact":"high","summary":"A use-after-free bug in the DOM Core and HTML component of Firefox was fixed in Firefox 159 and ESR 115.44 and 153.6. Memory reuse after free can let a crafted web page corrupt memory and may allow code execution, though the sources do not state the impact.","category":"runtime","nicknames":[],"who_cares":["firefox","desktop","browsers"],"confidence":0.5,"needs_auth":"no","worst_case":"unknown; use-after-free may allow memory corruption or code execution","analyst_note":"Check the Mozilla security advisory for this CVE to confirm impact, exploitation requirements and whether it is exploited in the wild.","how_to_check":"- Run `firefox --version` (or check About Firefox) and compare against `159`, `115.44` and `153.6`\n- Check the ESR line in use with the Firefox ESR version shown in About Firefox\n- Check managed fleets for the Firefox version reported by the deployment tool","needs_analyst":true,"not_affected_if":["fixed-version"],"who_is_affected":"Anyone running an affected Firefox build who browses untrusted web content is potentially exposed, since the bug sits in the DOM code that handles pages. Teams whose machines run only fixed or newer builds can skip it. The sources do not say whether exploitation requires any particular browser setting.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000635,"input_tokens":3254,"output_tokens":619,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-117895':17A,20A '-2026':16A,19A '115.44':47B,94C '153.6':49B,98C '159':44B,91C 'allow':64B 'attack':12A 'browser':21B 'bug':30B 'code':14A,65B 'compon':37B,84C 'core':8A,34B,82C 'corrupt':60B 'craft':57B 'cve':15A,18A 'desktop':22B 'dom':7A,33B,81C 'esr':46B,93C,97C 'execut':66B 'firefox':1A,23B,39B,43B,90C,92C,96C 'fix':41B,88C 'free':5A,29B,53B,78C 'html':10A,36B,83C 'impact':74B 'let':11A,55B 'may':63B 'memori':50B,61B 'page':59B 'reus':51B 'run':13A 'runtim':24B 'sourc':69B 'state':72B 'though':67B 'use':3A,27B,76C 'use-after-fre':2A,26B,75C 'vulner':86C 'web':58B","nicknames":[],"mitigations":[],"who_affected":"Anyone running an affected Firefox build who browses untrusted web content is potentially exposed, since the bug sits in the DOM code that handles pages. Teams whose machines run only fixed or newer builds can skip it. The sources do not say whether exploitation requires any particular browser setting.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-27T14:16:44+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-117895","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117895","severity":null,"published_at":"2026-10-27T14:16:44+00:00","modified_at":"2026-10-27T14:16:44+00:00","first_seen_at":"2026-10-27T14:32:22+00:00","fetched_at":"2026-10-27T14:32:22+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}