{"id":"CVE-2026-117904","kind":"vulnerability","aliases":["CVE-2026-117904"],"related":[],"title":"Firefox: JavaScript garbage collector use-after-free fixed in 159","description":"Use-after-free in the JavaScript: GC component. This vulnerability was fixed in Firefox 159 and Firefox ESR 153.6.","summary":"A use-after-free bug in the JavaScript garbage collector of Firefox can corrupt memory when the browser runs crafted script. The sources say it was fixed in Firefox 159 and Firefox ESR 153.6, but do not describe the attacker's exact outcome.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["desktop-browsers","firefox","runtime"],"not_affected_if":["esr-153.6-or-later","firefox-159-or-later"],"how_to_check":"- Check the installed Firefox version in the browser's About page or with `firefox --version`, and compare it to `159` or `153.6` for ESR.","fix":"- Update Firefox to `159` or later, or Firefox ESR to `153.6` or later.","status":"open","published_at":"2026-10-27T14:16:45+00:00","first_seen_at":"2026-10-27T14:32:22+00:00","triaged_at":"2026-10-27T14:37:35+00:00","updated_at":"2026-10-27T14:37:35+00:00","category":"runtime","confidence":0.5,"triage":{"at":"2026-10-27T14:37:35Z","model":"claude-haiku-5-5","output":{"fix":"- Update Firefox to `159` or later, or Firefox ESR to `153.6` or later.","reach":"internet","title":"Firefox: JavaScript garbage collector use-after-free fixed in 159","impact":"high","summary":"A use-after-free bug in the JavaScript garbage collector of Firefox can corrupt memory when the browser runs crafted script. The sources say it was fixed in Firefox 159 and Firefox ESR 153.6, but do not describe the attacker's exact outcome.","category":"runtime","nicknames":[],"who_cares":["firefox","desktop-browsers"],"confidence":0.5,"needs_auth":"unknown","worst_case":"unknown; memory corruption in the browser could allow code execution","analyst_note":"Check the Mozilla security advisory for this CVE for exploit conditions, whether it is reachable from web content, and the exact impact; the NVD entry gave no CVSS score.","how_to_check":"- Check the installed Firefox version in the browser's About page or with `firefox --version`, and compare it to `159` or `153.6` for ESR.","needs_analyst":true,"not_affected_if":["firefox-159-or-later","esr-153.6-or-later"],"who_is_affected":"Anyone running Firefox or Firefox ESR builds older than the fixed versions on desktops or servers where the browser loads web content. The sources do not say which configurations are affected beyond that; headless or managed deployments that never load untrusted pages are likely lower risk, but this is not stated in the sources.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000606,"input_tokens":3238,"output_tokens":564,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-117904':14A,17A '-2026':13A,16A '153.6':57B,86C '159':11A,53B,82C 'attack':63B 'browser':20B,41B 'bug':28B 'collector':4A,33B 'compon':75C 'corrupt':37B 'craft':43B 'cve':12A,15A 'describ':61B 'desktop':19B 'desktop-brows':18B 'esr':56B,85C 'exact':65B 'firefox':1A,21B,35B,52B,55B,81C,84C 'fix':9A,50B,79C 'free':8A,27B,70C 'garbag':3A,32B 'gc':74C 'javascript':2A,31B,73C 'memori':38B 'outcom':66B 'run':42B 'runtim':22B 'say':47B 'script':44B 'sourc':46B 'use':6A,25B,68C 'use-after-fre':5A,24B,67C 'vulner':77C","nicknames":[],"mitigations":[],"who_affected":"Anyone running Firefox or Firefox ESR builds older than the fixed versions on desktops or servers where the browser loads web content. The sources do not say which configurations are affected beyond that; headless or managed deployments that never load untrusted pages are likely lower risk, but this is not stated in the sources.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-27T14:16:45+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-117904","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117904","severity":null,"published_at":"2026-10-27T14:16:45+00:00","modified_at":"2026-10-27T14:16:45+00:00","first_seen_at":"2026-10-27T14:32:22+00:00","fetched_at":"2026-10-27T14:32:22+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}