Live › vulnerability › CVE-2026-117941
Go to dashboardA use-after-free bug in the CSS Object Model component of Firefox lets memory be used after it was freed. The sources do not say what an attacker can do with it, so the impact is unconfirmed.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-27 14:32 UTC. All times on this page are UTC.
Anyone running a Firefox build older than the fixed versions named in the advisory, on desktop or ESR channels. The sources do not say whether a specific page or content type is needed to trigger it.
No product ranges from the sources yet.
firefox --version (or check About Firefox) and compare against 159 or the ESR builds 115.44 and 153.6159, or Firefox ESR to 115.44 or 153.6Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Use-after-free in the DOM: CSS Object Model component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, and Firefox ESR 153.6.
This page as .md · .json · in your agent: get_signal("CVE-2026-117941")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.