Live › vulnerability › CVE-2026-117943
Go to dashboardA use-after-free flaw in the DOM Core and HTML component of Firefox was fixed in Firefox 159 and ESR 115.44 and 153.6. A use-after-free can let a crafted web page crash the browser or, in the worst case, run attacker code.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-27 14:32 UTC. All times on this page are UTC.
Any installed Firefox build older than the fixed versions is in scope, since the flaw is in the browser's DOM handling of web content. Teams running Firefox ESR on managed desktops should patch the ESR branch they use. Systems that only run a different browser or headless tooling with no Firefox binary can skip it.
No product ranges from the sources yet.
firefox --version (or check Help > About Firefox) and compare against 159 or the ESR builds 115.44 and 153.6firefox --version on managed machines159 or later115.44 or 153.6, depending on the branch in useEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, and Firefox ESR 153.6.
This page as .md · .json · in your agent: get_signal("CVE-2026-117943")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.