---
id: "CVE-2026-118005"
kind: "vulnerability"
aliases: ["CVE-2026-118005"]
title: "Firefox: use-after-free in WebRTC signaling lets attacker run code"
severity: "unknown"
cvss: null
epss: null
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["browsers", "desktop", "firefox", "runtime"]
not_affected_if: ["firefox-159-or-later"]
published_at: "2026-10-27T14:16:58+00:00"
first_seen_at: "2026-10-27T14:32:25+00:00"
updated_at: "2026-10-27T14:33:39+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-118005", "first_seen_at": "2026-10-27T14:32:25+00:00"}]
---

# Firefox: use-after-free in WebRTC signaling lets attacker run code

A use-after-free bug in the WebRTC signaling component of Firefox could let an attacker corrupt memory. The description says it was fixed in Firefox 159 and says nothing about the exact exploit outcome.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- `Help > About Firefox` to read the installed version
- Compare against `159` or later

## Fix

- Update Firefox to `159` or later

## Timeline

- 2026-10-27T14:32:25+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-118005

## From the sources

Use-after-free in the WebRTC: Signaling component. This vulnerability was fixed in Firefox 159.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_