How do I check whether I am affected by CVE-2026-118006?

- Run `firefox --version` and compare against the fixed release. - Check Help > About Firefox in the browser to confirm the installed version.

What is the fix for CVE-2026-118006?

- Update Firefox to `159` or later.

Who is not affected by CVE-2026-118006?

Not affected if: firefox-159-or-later.

Live › vulnerability › CVE-2026-118006

Go to dashboard

unknownRuntime

Firefox: use-after-free in WebRTC signaling enables privilege escalation

A use-after-free bug in the WebRTC signaling component of Firefox lets code reuse freed memory. The sources say this leads to privilege escalation, but they give no detail on the exact trigger.

Summary written from the sources below. Check the originals before acting.

Known so far

3/6

unknown

no CVSS yet; severity from the sources

known so far3 of 6

missing: versions, primary source, exploitation

First public: Oct 27, 2026 UTC
Last modified: Oct 27, 2026
Status: open
Known exploitation: None reported
Public exploit: None on GitHub
EPSS: not scored

First seen by InfraStack 2026-10-27 14:32 UTC. All times on this page are UTC.

Why it is unknown, and not just CVSS

Likelihood → · Impact ↓

critical

high

medium

high

medium

low

medium

low

Exploited: No reports yet.
Needs login: Not known from the sources.
Needs a special setup: Not known from the sources.
Reachable from: Not known from the sources.
Worst case: Attacker escalates privileges inside the browser process.
CVSS said: No score. The facts above say medium; we keep the sources' unknown until an analyst looks.

Who is affected

Anyone running Firefox builds older than version 159 on a desktop or device. The sources do not say whether specific configurations or WebRTC usage are required to be exposed.

Know the next one before it finds you.

Add to Slack

Live › vulnerability › CVE-2026-118006

Go to dashboard

unknownRuntime

Firefox: use-after-free in WebRTC signaling enables privilege escalation

A use-after-free bug in the WebRTC signaling component of Firefox lets code reuse freed memory. The sources say this leads to privilege escalation, but they give no detail on the exact trigger.

Summary written from the sources below. Check the originals before acting.

Known so far

3/6

unknown

no CVSS yet; severity from the sources

known so far3 of 6

missing: versions, primary source, exploitation

First public: Oct 27, 2026 UTC
Last modified: Oct 27, 2026
Status: open
Known exploitation: None reported
Public exploit: None on GitHub
EPSS: not scored

First seen by InfraStack 2026-10-27 14:32 UTC. All times on this page are UTC.

Why it is unknown, and not just CVSS

Likelihood → · Impact ↓

critical

high

medium

high

medium

low

medium

low

Exploited: No reports yet.
Needs login: Not known from the sources.
Needs a special setup: Not known from the sources.
Reachable from: Not known from the sources.
Worst case: Attacker escalates privileges inside the browser process.
CVSS said: No score. The facts above say medium; we keep the sources' unknown until an analyst looks.

Who is affected

Anyone running Firefox builds older than version 159 on a desktop or device. The sources do not say whether specific configurations or WebRTC usage are required to be exposed.

Know the next one before it finds you.

Add to Slack

Firefox: use-after-free in WebRTC signaling enables privilege escalation

Why it is unknown, and not just CVSS

Who is affected

Know the next one before it finds you.

Firefox: use-after-free in WebRTC signaling enables privilege escalation

Why it is unknown, and not just CVSS

Who is affected

Know the next one before it finds you.

How to check

The fix

Who had it, and when

What the sources say, verbatim

Sources