Live › vulnerability › CVE-2026-117985
Go to dashboardA use-after-free bug in Firefox's Graphics component allows a crafted page to escape the browser sandbox. An attacker who lures a user to a malicious page could gain code execution outside the sandboxed content process.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-27 14:32 UTC. All times on this page are UTC.
Anyone running desktop Firefox or Firefox ESR on a version older than 159 or 153.6 is exposed when browsing untrusted pages. Servers and managed environments without a browser are not affected. Teams with a fixed browser version pinned by policy can skip it once that version is confirmed as patched.
No product ranges from the sources yet.
firefox --version (or check Help > About Firefox) and compare against 159 for Firefox or 153.6 for Firefox ESR159 or later153.6 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Sandbox escape due to use-after-free in the Graphics component. This vulnerability was fixed in Firefox 159 and Firefox ESR 153.6.
This page as .md · .json · in your agent: get_signal("CVE-2026-117985")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.