Live › vulnerability › CVE-2026-117968
Go to dashboardA use-after-free bug in the DOM Core and HTML component of Firefox lets memory be reused after it is freed. The sources do not say what an attacker gets beyond that, so the reach of the flaw is unconfirmed.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-27 14:32 UTC. All times on this page are UTC.
Anyone running a Firefox build older than the fixed releases on desktops or managed fleets. The sources do not say whether the flaw is reachable from web content alone or needs a particular setting. Teams that only run the latest fixed release can skip it.
No product ranges from the sources yet.
firefox --version, and compare it to the fixed releases.115.44 or 153.6 or later.159 or later.115.44 or later.153.6 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, and Firefox ESR 153.6.
This page as .md · .json · in your agent: get_signal("CVE-2026-117968")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.