{"id":"CVE-2026-117898","kind":"vulnerability","aliases":["CVE-2026-117898"],"related":[],"title":"Firefox: JIT engine use-after-free flaw fixed in version 159","description":"Use-after-free in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 159 and Firefox ESR 153.6.","summary":"A use-after-free bug in the JIT component of Firefox's JavaScript engine lets memory be reused after it is freed. The sources do not say what an attacker can achieve with it beyond that.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["browsers","desktop","firefox","runtime"],"not_affected_if":["esr-153.6-or-later","firefox-159-or-later"],"how_to_check":"- Check the installed Firefox version in the browser's About page or with `firefox --version`\n- Compare against the fixed versions `159` and ESR `153.6`\n- unknown for any other check","fix":"- Update Firefox to `159` or later\n- Update Firefox ESR to `153.6` or later","status":"open","published_at":"2026-10-27T14:16:45+00:00","first_seen_at":"2026-10-27T14:32:22+00:00","triaged_at":"2026-10-27T14:37:41+00:00","updated_at":"2026-10-27T14:37:41+00:00","category":"runtime","confidence":0.5,"triage":{"at":"2026-10-27T14:37:41Z","model":"claude-haiku-5-5","output":{"fix":"- Update Firefox to `159` or later\n- Update Firefox ESR to `153.6` or later","reach":"internet","title":"Firefox: JIT engine use-after-free flaw fixed in version 159","impact":"high","summary":"A use-after-free bug in the JIT component of Firefox's JavaScript engine lets memory be reused after it is freed. The sources do not say what an attacker can achieve with it beyond that.","category":"runtime","nicknames":[],"who_cares":["firefox","browsers","desktop"],"confidence":0.5,"needs_auth":"unknown","worst_case":"unknown; sources do not describe the attacker outcome","analyst_note":"Check the Mozilla security advisory for this CVE to confirm severity, exploit conditions and whether it is exploited in the wild.","how_to_check":"- Check the installed Firefox version in the browser's About page or with `firefox --version`\n- Compare against the fixed versions `159` and ESR `153.6`\n- unknown for any other check","needs_analyst":true,"not_affected_if":["firefox-159-or-later","esr-153.6-or-later"],"who_is_affected":"Anyone running Firefox or Firefox ESR older than the fixed versions, including desktop browsers used on managed endpoints. The sources do not say whether specific configurations or settings change exposure.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000576,"input_tokens":3246,"output_tokens":502,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-117898':15A,18A '-2026':14A,17A '153.6':79C '159':12A,75C 'achiev':55B 'attack':53B 'beyond':58B 'browser':19B 'bug':28B 'compon':32B,68C 'cve':13A,16A 'desktop':20B 'engin':3A,37B,66C 'esr':78C 'firefox':1A,21B,34B,74C,77C 'fix':9A,72C 'flaw':8A 'free':7A,27B,62C 'freed':45B 'javascript':36B,65C 'jit':2A,31B,67C 'let':38B 'memori':39B 'reus':41B 'runtim':22B 'say':50B 'sourc':47B 'use':5A,25B,60C 'use-after-fre':4A,24B,59C 'version':11A 'vulner':70C","nicknames":[],"mitigations":[],"who_affected":"Anyone running Firefox or Firefox ESR older than the fixed versions, including desktop browsers used on managed endpoints. The sources do not say whether specific configurations or settings change exposure.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-27T14:16:45+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-117898","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117898","severity":null,"published_at":"2026-10-27T14:16:45+00:00","modified_at":"2026-10-27T14:16:45+00:00","first_seen_at":"2026-10-27T14:32:22+00:00","fetched_at":"2026-10-27T14:32:22+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}