Live › vulnerability › CVE-2026-117929
Go to dashboardA use-after-free bug in the Firefox DOM Core and HTML component lets memory that was already released be reused. The sources do not say what an attacker gets beyond that, so the reach and impact below are unconfirmed.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-27 14:32 UTC. All times on this page are UTC.
Anyone running Firefox builds before the fixed versions, including Firefox ESR 115 and ESR 153 lines, is exposed. The sources do not say which page or content triggers the bug, so unknown whether a plain web visit is enough. Teams that only use managed, auto-updated browsers are likely covered once updates land.
No product ranges from the sources yet.
firefox --version or check Help > About Firefox and compare with the fixed versions115.44 or 153.6, or a newer build159 or later115.44 or 153.6 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, and Firefox ESR 153.6.
This page as .md · .json · in your agent: get_signal("CVE-2026-117929")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.