{"id":"CVE-2026-117921","kind":"vulnerability","aliases":["CVE-2026-117921"],"related":[],"title":"Firefox: use-after-free in CSS parsing lets attacker run code","description":"Use-after-free in the CSS Parsing and Computation component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, and Firefox ESR 153.6.","summary":"A use-after-free bug in Firefox's CSS Parsing and Computation component lets memory be reused after it is freed. The sources do not say what an attacker can achieve beyond that, and Mozilla's fixed releases are Firefox 159, Firefox ESR 115.44 and Firefox ESR 153.6.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["browser","desktop","firefox","runtime"],"not_affected_if":["already-patched-version"],"how_to_check":"- Check the installed Firefox version in Help > About Firefox, or run `firefox --version` on Linux.\n- Compare it against `159`, `115.44` (ESR) and `153.6` (ESR); anything older on the matching branch is affected.","fix":"- Update Firefox to `159` or later.\n- Update Firefox ESR to `115.44` or `153.6` on the matching ESR branch.","status":"open","published_at":"2026-10-27T14:16:47+00:00","first_seen_at":"2026-10-27T14:32:22+00:00","triaged_at":"2026-10-27T14:37:18+00:00","updated_at":"2026-10-27T14:37:18+00:00","category":"runtime","confidence":0.5,"triage":{"at":"2026-10-27T14:37:18Z","model":"claude-haiku-5-5","output":{"fix":"- Update Firefox to `159` or later.\n- Update Firefox ESR to `115.44` or `153.6` on the matching ESR branch.","reach":"internet","title":"Firefox: use-after-free in CSS parsing lets attacker run code","impact":"high","summary":"A use-after-free bug in Firefox's CSS Parsing and Computation component lets memory be reused after it is freed. The sources do not say what an attacker can achieve beyond that, and Mozilla's fixed releases are Firefox 159, Firefox ESR 115.44 and Firefox ESR 153.6.","category":"runtime","nicknames":[],"who_cares":["firefox","desktop","browser"],"confidence":0.5,"needs_auth":"no","worst_case":"unknown; memory corruption may let page content run code","analyst_note":"Check the Mozilla security advisory for this CVE to confirm exploitability, whether it was exploited in the wild, and the impact of the use-after-free.","how_to_check":"- Check the installed Firefox version in Help > About Firefox, or run `firefox --version` on Linux.\n- Compare it against `159`, `115.44` (ESR) and `153.6` (ESR); anything older on the matching branch is affected.","needs_analyst":true,"not_affected_if":["already-patched-version"],"who_is_affected":"Anyone running a Firefox build older than the fixed versions is exposed, because the flaw sits in the browser's own CSS handling and any web page can supply CSS. Systems that only run a locked-down Firefox ESR on an older branch should confirm they have moved to a patched ESR release. Teams with no Firefox installs can skip it.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000631,"input_tokens":3256,"output_tokens":610,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-117921':15A,18A '-2026':14A,17A '115.44':67B,92C '153.6':71B,96C '159':64B,89C 'achiev':54B 'attack':10A,52B 'beyond':55B 'browser':19B 'bug':28B 'code':12A 'compon':36B,82C 'comput':35B,81C 'css':7A,32B,78C 'cve':13A,16A 'desktop':20B 'esr':66B,70B,91C,95C 'firefox':1A,21B,30B,63B,65B,69B,88C,90C,94C 'fix':60B,86C 'free':5A,27B,75C 'freed':44B 'let':9A,37B 'memori':38B 'mozilla':58B 'pars':8A,33B,79C 'releas':61B 'reus':40B 'run':11A 'runtim':22B 'say':49B 'sourc':46B 'use':3A,25B,73C 'use-after-fre':2A,24B,72C 'vulner':84C","nicknames":[],"mitigations":[],"who_affected":"Anyone running a Firefox build older than the fixed versions is exposed, because the flaw sits in the browser's own CSS handling and any web page can supply CSS. Systems that only run a locked-down Firefox ESR on an older branch should confirm they have moved to a patched ESR release. Teams with no Firefox installs can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-27T14:16:47+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-117921","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117921","severity":null,"published_at":"2026-10-27T14:16:47+00:00","modified_at":"2026-10-27T14:16:47+00:00","first_seen_at":"2026-10-27T14:32:22+00:00","fetched_at":"2026-10-27T14:32:22+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}