{"id":"CVE-2026-117940","kind":"vulnerability","aliases":["CVE-2026-117940"],"related":[],"title":"Firefox: use-after-free in DOM Core and HTML component","description":"Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 159 and Firefox ESR 153.6.","summary":"A use-after-free bug in the DOM Core and HTML component of Firefox lets a web page corrupt browser memory. The sources do not say what an attacker can get beyond that, such as code execution.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["browser","desktop","firefox","other"],"not_affected_if":["firefox-159-or-later","firefox-esr-153.6-or-later"],"how_to_check":"- Run `firefox --version` or open the About Firefox page and compare against `159` or ESR `153.6`\n- unknown for other checks, the sources do not say","fix":"- Update Firefox to `159` or Firefox ESR to `153.6`\n- unknown for other fixes, the sources do not say","status":"open","published_at":"2026-10-27T14:16:49+00:00","first_seen_at":"2026-10-27T14:32:23+00:00","triaged_at":"2026-10-27T14:36:58+00:00","updated_at":"2026-10-27T14:36:58+00:00","category":"other","confidence":0.4,"triage":{"at":"2026-10-27T14:36:58Z","model":"claude-haiku-5-5","output":{"fix":"- Update Firefox to `159` or Firefox ESR to `153.6`\n- unknown for other fixes, the sources do not say","reach":"internet","title":"Firefox: use-after-free in DOM Core and HTML component","impact":"medium","summary":"A use-after-free bug in the DOM Core and HTML component of Firefox lets a web page corrupt browser memory. The sources do not say what an attacker can get beyond that, such as code execution.","category":"other","nicknames":[],"who_cares":["firefox","desktop","browser"],"confidence":0.4,"needs_auth":"unknown","worst_case":"unknown; memory corruption in the browser, exact outcome not stated","analyst_note":"Check the Mozilla security advisory for CVE-2026-117940 to confirm severity, exploitation conditions and whether code execution is possible.","how_to_check":"- Run `firefox --version` or open the About Firefox page and compare against `159` or ESR `153.6`\n- unknown for other checks, the sources do not say","needs_analyst":true,"not_affected_if":["firefox-159-or-later","firefox-esr-153.6-or-later"],"who_is_affected":"Teams whose staff or systems run Firefox versions older than 159 or ESR older than 153.6 are exposed. The sources do not say which configurations or platforms are affected beyond that, so unknown for anything more specific.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000583,"input_tokens":3242,"output_tokens":518,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-117940':14A,17A '-2026':13A,16A '153.6':79C '159':75C 'attack':50B 'beyond':53B 'browser':18B,41B 'bug':26B 'code':57B 'compon':11A,33B,68C 'core':8A,30B,66C 'corrupt':40B 'cve':12A,15A 'desktop':19B 'dom':7A,29B,65C 'esr':78C 'execut':58B 'firefox':1A,20B,35B,74C,77C 'fix':72C 'free':5A,25B,62C 'get':52B 'html':10A,32B,67C 'let':36B 'memori':42B 'page':39B 'say':47B 'sourc':44B 'use':3A,23B,60C 'use-after-fre':2A,22B,59C 'vulner':70C 'web':38B","nicknames":[],"mitigations":[],"who_affected":"Teams whose staff or systems run Firefox versions older than 159 or ESR older than 153.6 are exposed. The sources do not say which configurations or platforms are affected beyond that, so unknown for anything more specific.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-27T14:16:49+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-117940","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117940","severity":null,"published_at":"2026-10-27T14:16:49+00:00","modified_at":"2026-10-27T14:16:49+00:00","first_seen_at":"2026-10-27T14:32:23+00:00","fetched_at":"2026-10-27T14:32:23+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}