Live › vulnerability › CVE-2026-117919
Go to dashboardA use-after-free bug in the DOM Core and HTML component of Firefox was fixed in Firefox 159 and the ESR releases 115.44 and 153.6. Use-after-free flaws of this kind can let a crafted web page corrupt memory and may allow code execution, but the sources do not state the impact.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-27 14:32 UTC. All times on this page are UTC.
Anyone running an unpatched Firefox build that renders web content, including desktop installs and managed fleets pinned to ESR. Systems already on Firefox 159, ESR 115.44 or ESR 153.6 or later are not affected by this specific fix. The sources do not say which configurations or page types trigger the bug.
No product ranges from the sources yet.
firefox --version on the machine.159, 115.44 or 153.6 for the matching ESR branch.159 or later on the current release channel.115.44 or 153.6 on the ESR channel, depending on the branch in use.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, and Firefox ESR 153.6.
This page as .md · .json · in your agent: get_signal("CVE-2026-117919")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.