Live › vulnerability › CVE-2026-117935
Go to dashboardFirefox has a use-after-free bug in its DOM bindings (WebIDL) component, where memory is used after it has been released. The sources do not say what an attacker gets beyond the general class of memory corruption, so the impact is unconfirmed.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-27 14:32 UTC. All times on this page are UTC.
Anyone running Firefox or Firefox ESR builds older than the fixed releases, including desktop users and managed fleets that pin ESR versions. The sources do not say whether the bug is reachable without visiting a malicious page, so assume normal browsing exposure until confirmed. Teams on managed browsers with auto-update already covered can skip it once the fixed build is confirmed.
No product ranges from the sources yet.
about:support or the Help menu and compare it against the fixed releases.115.44 or 153.6.159 or later.115.44 or 153.6 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Use-after-free in the DOM: Bindings (WebIDL) component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, and Firefox ESR 153.6.
This page as .md · .json · in your agent: get_signal("CVE-2026-117935")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.