{"id":"CVE-2026-117943","kind":"vulnerability","aliases":["CVE-2026-117943"],"related":[],"title":"Firefox: use-after-free in DOM core lets page content corrupt memory","description":"Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, and Firefox ESR 153.6.","summary":"A use-after-free flaw in the DOM Core and HTML component of Firefox was fixed in Firefox 159 and ESR 115.44 and 153.6. A use-after-free can let a crafted web page crash the browser or, in the worst case, run attacker code.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["browser","desktop","firefox","package"],"not_affected_if":["no-firefox-installed","patched-versions"],"how_to_check":"- Run `firefox --version` (or check Help > About Firefox) and compare against `159` or the ESR builds `115.44` and `153.6`\n- Check the ESR branch in use with `firefox --version` on managed machines","fix":"- Update Firefox to `159` or later\n- Update Firefox ESR to `115.44` or `153.6`, depending on the branch in use","status":"open","published_at":"2026-10-27T14:16:49+00:00","first_seen_at":"2026-10-27T14:32:23+00:00","triaged_at":"2026-10-27T14:35:45+00:00","updated_at":"2026-10-27T14:35:45+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-10-27T14:35:45Z","model":"claude-haiku-5-5","output":{"fix":"- Update Firefox to `159` or later\n- Update Firefox ESR to `115.44` or `153.6`, depending on the branch in use","reach":"internet","title":"Firefox: use-after-free in DOM core lets page content corrupt memory","impact":"high","summary":"A use-after-free flaw in the DOM Core and HTML component of Firefox was fixed in Firefox 159 and ESR 115.44 and 153.6. A use-after-free can let a crafted web page crash the browser or, in the worst case, run attacker code.","category":"package","nicknames":[],"who_cares":["firefox","desktop","browser"],"confidence":0.5,"needs_auth":"no","worst_case":"Crafted web page may crash the browser or run attacker code","analyst_note":"Check the Mozilla security advisory for this CVE to confirm severity, exploitation status and whether the flaw is reachable without user interaction.","how_to_check":"- Run `firefox --version` (or check Help > About Firefox) and compare against `159` or the ESR builds `115.44` and `153.6`\n- Check the ESR branch in use with `firefox --version` on managed machines","needs_analyst":true,"not_affected_if":["no-firefox-installed","patched-versions"],"who_is_affected":"Any installed Firefox build older than the fixed versions is in scope, since the flaw is in the browser's DOM handling of web content. Teams running Firefox ESR on managed desktops should patch the ESR branch they use. Systems that only run a different browser or headless tooling with no Firefox binary can skip it.","user_interaction":"yes","needs_special_setup":"no","severity_if_unknown":"unknown"},"cost_usd":0.000614,"input_tokens":3254,"output_tokens":577,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-117943':16A,19A '-2026':15A,18A '115.44':46B,90C '153.6':48B,94C '159':43B,87C 'attack':69B 'browser':20B,62B 'case':67B 'code':70B 'compon':36B,80C 'content':11A 'core':8A,33B,78C 'corrupt':12A 'craft':57B 'crash':60B 'cve':14A,17A 'desktop':21B 'dom':7A,32B,77C 'esr':45B,89C,93C 'firefox':1A,22B,38B,42B,86C,88C,92C 'fix':40B,84C 'flaw':29B 'free':5A,28B,53B,74C 'html':35B,79C 'let':9A,55B 'memori':13A 'packag':23B 'page':10A,59B 'run':68B 'use':3A,26B,51B,72C 'use-after-fre':2A,25B,50B,71C 'vulner':82C 'web':58B 'worst':66B","nicknames":[],"mitigations":[],"who_affected":"Any installed Firefox build older than the fixed versions is in scope, since the flaw is in the browser's DOM handling of web content. Teams running Firefox ESR on managed desktops should patch the ESR branch they use. Systems that only run a different browser or headless tooling with no Firefox binary can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-27T14:16:49+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-117943","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117943","severity":null,"published_at":"2026-10-27T14:16:49+00:00","modified_at":"2026-10-27T14:16:49+00:00","first_seen_at":"2026-10-27T14:32:23+00:00","fetched_at":"2026-10-27T14:32:23+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}