{"id":"CVE-2026-117910","kind":"vulnerability","aliases":["CVE-2026-117910"],"related":[],"title":"Firefox: invalid pointer in JavaScript engine may allow memory corruption","description":"Invalid pointer in the JavaScript Engine component. This vulnerability was fixed in Firefox 159 and Firefox ESR 153.6.","summary":"An invalid pointer in Firefox's JavaScript Engine was fixed in Firefox 159 and Firefox ESR 153.6. The sources do not say what an attacker can do with it beyond the memory error itself.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["browser","desktop","firefox","runtime"],"not_affected_if":["already-on-fixed-version"],"how_to_check":"- Check the installed Firefox version in the About Firefox dialog or with `firefox --version`; releases before `159` and ESR before `153.6` are affected.","fix":"- Update Firefox to `159` or later, or Firefox ESR to `153.6` or later.","status":"open","published_at":"2026-10-27T14:16:46+00:00","first_seen_at":"2026-10-27T14:32:22+00:00","triaged_at":"2026-10-27T14:37:28+00:00","updated_at":"2026-10-27T14:37:28+00:00","category":"runtime","confidence":0.5,"triage":{"at":"2026-10-27T14:37:28Z","model":"claude-haiku-5-5","output":{"fix":"- Update Firefox to `159` or later, or Firefox ESR to `153.6` or later.","reach":"unknown","title":"Firefox: invalid pointer in JavaScript engine may allow memory corruption","impact":"high","summary":"An invalid pointer in Firefox's JavaScript Engine was fixed in Firefox 159 and Firefox ESR 153.6. The sources do not say what an attacker can do with it beyond the memory error itself.","category":"runtime","nicknames":[],"who_cares":["firefox","browser","desktop"],"confidence":0.5,"needs_auth":"unknown","worst_case":"unknown; memory corruption in browser JavaScript engine","analyst_note":"Check Mozilla's security advisory for this CVE to confirm attack vector, exploitability and severity; the NVD entry gives none of these.","how_to_check":"- Check the installed Firefox version in the About Firefox dialog or with `firefox --version`; releases before `159` and ESR before `153.6` are affected.","needs_analyst":true,"not_affected_if":["already-on-fixed-version"],"who_is_affected":"Anyone running Firefox or Firefox ESR before the fixed versions, on desktop or wherever the browser is deployed. Systems already on Firefox 159 or ESR 153.6 or later are not affected by this entry. The sources do not say what triggers the flaw or whether web content alone can reach it.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000589,"input_tokens":3240,"output_tokens":530,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-117910':13A,16A '-2026':12A,15A '153.6':37B,71C '159':33B,67C 'allow':8A 'attack':45B 'beyond':50B 'browser':17B 'compon':60C 'corrupt':10A 'cve':11A,14A 'desktop':18B 'engin':6A,28B,59C 'error':53B 'esr':36B,70C 'firefox':1A,19B,25B,32B,35B,66C,69C 'fix':30B,64C 'invalid':2A,22B,54C 'javascript':5A,27B,58C 'may':7A 'memori':9A,52B 'pointer':3A,23B,55C 'runtim':20B 'say':42B 'sourc':39B 'vulner':62C","nicknames":[],"mitigations":[],"who_affected":"Anyone running Firefox or Firefox ESR before the fixed versions, on desktop or wherever the browser is deployed. Systems already on Firefox 159 or ESR 153.6 or later are not affected by this entry. The sources do not say what triggers the flaw or whether web content alone can reach it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-27T14:16:46+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-117910","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117910","severity":null,"published_at":"2026-10-27T14:16:46+00:00","modified_at":"2026-10-27T14:16:46+00:00","first_seen_at":"2026-10-27T14:32:22+00:00","fetched_at":"2026-10-27T14:32:22+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}