{"id":"CVE-2026-117930","kind":"vulnerability","aliases":["CVE-2026-117930"],"related":[],"title":"Firefox: use-after-free in DOM bindings can crash or run code","description":"Use-after-free in the DOM: Bindings (WebIDL) component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, and Firefox ESR 153.6.","summary":"A use-after-free bug in the DOM Bindings (WebIDL) component of Firefox lets memory be reused after it is freed. The sources do not say what an attacker can achieve beyond that, so the exact impact is unclear.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["browsers","desktop","firefox","runtime"],"not_affected_if":["already-on-fixed-version"],"how_to_check":"- Run `firefox --version` or open About Firefox and compare against `159`, `115.44` (ESR) and `153.6` (ESR)\n- Check whether the installed version is older than the fixed release for its branch","fix":"- Update Firefox to `159`, or to `115.44` on the ESR 115 branch, or to `153.6` on the ESR 153 branch","status":"open","published_at":"2026-10-27T14:16:48+00:00","first_seen_at":"2026-10-27T14:32:23+00:00","triaged_at":"2026-10-27T14:37:07+00:00","updated_at":"2026-10-27T14:37:07+00:00","category":"runtime","confidence":0.4,"triage":{"at":"2026-10-27T14:37:07Z","model":"claude-haiku-5-5","output":{"fix":"- Update Firefox to `159`, or to `115.44` on the ESR 115 branch, or to `153.6` on the ESR 153 branch","reach":"unknown","title":"Firefox: use-after-free in DOM bindings can crash or run code","impact":"high","summary":"A use-after-free bug in the DOM Bindings (WebIDL) component of Firefox lets memory be reused after it is freed. The sources do not say what an attacker can achieve beyond that, so the exact impact is unclear.","category":"runtime","nicknames":[],"who_cares":["firefox","desktop","browsers"],"confidence":0.4,"needs_auth":"unknown","worst_case":"unknown; memory corruption in browser, possibly code execution","analyst_note":"Check the Mozilla security advisory for this CVE to confirm exploit conditions, whether user interaction is needed, and the impact level, since the NVD entry gives only the fix versions.","how_to_check":"- Run `firefox --version` or open About Firefox and compare against `159`, `115.44` (ESR) and `153.6` (ESR)\n- Check whether the installed version is older than the fixed release for its branch","needs_analyst":true,"not_affected_if":["already-on-fixed-version"],"who_is_affected":"Anyone running a Firefox version older than the fixed releases on a branch they use, including desktop installs and managed fleets. The sources do not say which configurations or browsing conditions trigger the bug, so the exposure path is unknown.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000603,"input_tokens":3264,"output_tokens":553,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-117930':16A,19A '-2026':15A,18A '115.44':83C '153.6':87C '159':80C 'achiev':55B 'attack':53B 'beyond':56B 'bind':8A,33B,71C 'browser':20B 'bug':29B 'code':13A 'compon':35B,73C 'crash':10A 'cve':14A,17A 'desktop':21B 'dom':7A,32B,70C 'esr':82C,86C 'exact':60B 'firefox':1A,22B,37B,79C,81C,85C 'fix':77C 'free':5A,28B,67C 'freed':45B 'impact':61B 'let':38B 'memori':39B 'reus':41B 'run':12A 'runtim':23B 'say':50B 'sourc':47B 'unclear':63B 'use':3A,26B,65C 'use-after-fre':2A,25B,64C 'vulner':75C 'webidl':34B,72C","nicknames":[],"mitigations":[],"who_affected":"Anyone running a Firefox version older than the fixed releases on a branch they use, including desktop installs and managed fleets. The sources do not say which configurations or browsing conditions trigger the bug, so the exposure path is unknown.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-27T14:16:48+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-117930","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117930","severity":null,"published_at":"2026-10-27T14:16:48+00:00","modified_at":"2026-10-27T14:16:48+00:00","first_seen_at":"2026-10-27T14:32:23+00:00","fetched_at":"2026-10-27T14:32:23+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}