Live › vulnerability › CVE-2026-117938
Go to dashboardA use-after-free bug in the Layout component of Firefox lets memory be reused after it is released. The sources do not say what an attacker can do beyond that, and the fix is in Firefox 159 and Firefox ESR 115.44 and ESR 153.6.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-27 14:32 UTC. All times on this page are UTC.
Teams that run Firefox or Firefox ESR on their machines or in managed desktop fleets are affected, as the sources list these versions as the fixed ones. The sources do not say what data path or configuration makes a given install reachable by an attacker, so unknown whether a server-side team can skip it.
No product ranges from the sources yet.
firefox --version) and compare it to 159, 115.44 (ESR) or 153.6 (ESR).159 or later.115.44 or 153.6, depending on the ESR branch in use.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Use-after-free in the Layout component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, and Firefox ESR 153.6.
This page as .md · .json · in your agent: get_signal("CVE-2026-117938")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.