Live › vulnerability › CVE-2026-117940
Go to dashboardA use-after-free bug in the DOM Core and HTML component of Firefox lets a web page corrupt browser memory. The sources do not say what an attacker can get beyond that, such as code execution.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-27 14:32 UTC. All times on this page are UTC.
Teams whose staff or systems run Firefox versions older than 159 or ESR older than 153.6 are exposed. The sources do not say which configurations or platforms are affected beyond that, so unknown for anything more specific.
No product ranges from the sources yet.
firefox --version or open the About Firefox page and compare against 159 or ESR 153.6159 or Firefox ESR to 153.6Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 159 and Firefox ESR 153.6.
This page as .md · .json · in your agent: get_signal("CVE-2026-117940")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.