How do I check whether I am affected by CVE-2026-117901?

- Check the installed Firefox version in About Firefox or with the Firefox `--version` command - Check ESR installs against `115.44` and `153.6` branches - unknown for other checks

What is the fix for CVE-2026-117901?

- Update Firefox to `159` or later - Update Firefox ESR 115 to `115.44` or later - Update Firefox ESR 153 to `153.6` or later

Who is not affected by CVE-2026-117901?

Not affected if: already-on-fixed-version.

Live › vulnerability › CVE-2026-117901

Go to dashboard

unknownPackage

Firefox: use-after-free in DOM core lets page content crash or run code

A use-after-free bug in the DOM Core and HTML component of Firefox reuses memory after it has been released. Sources do not say what an attacker can get beyond memory corruption, so the impact is unconfirmed.

Summary written from the sources below. Check the originals before acting.

Known so far

3/6

unknown

no CVSS yet; severity from the sources

known so far3 of 6

missing: versions, primary source, exploitation

First public: Oct 27, 2026 UTC
Last modified: Oct 27, 2026
Status: open
Known exploitation: None reported
Public exploit: None on GitHub
EPSS: not scored

First seen by InfraStack 2026-10-27 14:32 UTC. All times on this page are UTC.

Why it is unknown, and not just CVSS

Likelihood → · Impact ↓

critical

high

medium

high

medium

low

medium

low

Exploited: No reports yet.
Needs login: No.
Needs a special setup: No.
Reachable from: internet.
Worst case: Attacker-controlled page content may corrupt memory and possibly run code.
CVSS said: No score. The facts above say critical; we keep the sources' unknown until an analyst looks.

Who is affected

Anyone running Firefox, Firefox ESR 115 or Firefox ESR 153 builds older than the fixed releases. Browsing untrusted pages is the usual exposure path. Sources do not describe any server-side or managed-hosting impact.

Know the next one before it finds you.

Add to Slack

Live › vulnerability › CVE-2026-117901

Go to dashboard

unknownPackage

Firefox: use-after-free in DOM core lets page content crash or run code

Summary written from the sources below. Check the originals before acting.

Known so far

3/6

unknown

no CVSS yet; severity from the sources

known so far3 of 6

missing: versions, primary source, exploitation

First public: Oct 27, 2026 UTC
Last modified: Oct 27, 2026
Status: open
Known exploitation: None reported
Public exploit: None on GitHub
EPSS: not scored

First seen by InfraStack 2026-10-27 14:32 UTC. All times on this page are UTC.

Why it is unknown, and not just CVSS

Likelihood → · Impact ↓

critical

high

medium

high

medium

low

medium

low

Exploited: No reports yet.
Needs login: No.
Needs a special setup: No.
Reachable from: internet.
Worst case: Attacker-controlled page content may corrupt memory and possibly run code.
CVSS said: No score. The facts above say critical; we keep the sources' unknown until an analyst looks.

Who is affected

Know the next one before it finds you.

Add to Slack

Firefox: use-after-free in DOM core lets page content crash or run code

Why it is unknown, and not just CVSS

Who is affected

Know the next one before it finds you.

Firefox: use-after-free in DOM core lets page content crash or run code

Why it is unknown, and not just CVSS

Who is affected

Know the next one before it finds you.

How to check

The fix

Who had it, and when

What the sources say, verbatim

Sources