Live › vulnerability › CVE-2026-117951
Go to dashboardA use-after-free bug in the DOM Core and HTML component of Firefox can corrupt memory when a page triggers it. The sources do not say what an attacker gets beyond memory corruption, so the impact is unconfirmed.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-27 14:32 UTC. All times on this page are UTC.
Anyone running an unpatched Firefox build that renders web content, including desktop installs on managed fleets. Server-side software that does not run a browser engine is not affected by this entry. The sources do not describe a configuration that changes exposure.
No product ranges from the sources yet.
about:support in Firefox and read the version; unknown whether the sources list affected versions beyond the fixed ones.159 or later on the current channel.115.44 on the 115 branch or 153.6 on the 153 branch.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, and Firefox ESR 153.6.
This page as .md · .json · in your agent: get_signal("CVE-2026-117951")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.