---
id: "CVE-2026-117925"
kind: "vulnerability"
aliases: ["CVE-2026-117925"]
title: "Firefox: use-after-free in DOM core lets a page run code"
severity: "unknown"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["browser", "desktop", "firefox", "package"]
not_affected_if: []
published_at: "2026-10-27T14:16:48+00:00"
first_seen_at: "2026-10-27T14:32:23+00:00"
updated_at: "2026-10-27T14:37:13+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-117925", "first_seen_at": "2026-10-27T14:32:23+00:00"}]
---

# Firefox: use-after-free in DOM core lets a page run code

Firefox has a use-after-free bug in its DOM Core and HTML component, where memory is used after it has been freed. The sources say it was fixed in Firefox 159, Firefox ESR 115.44 and Firefox ESR 153.6, but they do not state the attacker's exact gain.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Run `firefox --version` (or check About Firefox) and compare against `159`, `115.44` or `153.6` for ESR builds
- unknown

## Fix

- Update Firefox to `159` or later
- Update Firefox ESR to `115.44` or `153.6`
- unknown

## Timeline

- 2026-10-27T14:32:23+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-117925

## From the sources

Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, and Firefox ESR 153.6.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_