Live › vulnerability › CVE-2026-117921
Go to dashboardA use-after-free bug in Firefox's CSS Parsing and Computation component lets memory be reused after it is freed. The sources do not say what an attacker can achieve beyond that, and Mozilla's fixed releases are Firefox 159, Firefox ESR 115.44 and Firefox ESR 153.6.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-27 14:32 UTC. All times on this page are UTC.
Anyone running a Firefox build older than the fixed versions is exposed, because the flaw sits in the browser's own CSS handling and any web page can supply CSS. Systems that only run a locked-down Firefox ESR on an older branch should confirm they have moved to a patched ESR release. Teams with no Firefox installs can skip it.
No product ranges from the sources yet.
firefox --version on Linux.159, 115.44 (ESR) and 153.6 (ESR); anything older on the matching branch is affected.159 or later.115.44 or 153.6 on the matching ESR branch.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Use-after-free in the CSS Parsing and Computation component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, and Firefox ESR 153.6.
This page as .md · .json · in your agent: get_signal("CVE-2026-117921")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.