{"id":"CVE-2026-118006","kind":"vulnerability","aliases":["CVE-2026-118006"],"related":[],"title":"Firefox: use-after-free in WebRTC signaling enables privilege escalation","description":"Privilege escalation due to use-after-free in the WebRTC: Signaling component. This vulnerability was fixed in Firefox 159.","summary":"A use-after-free bug in the WebRTC signaling component of Firefox lets code reuse freed memory. The sources say this leads to privilege escalation, but they give no detail on the exact trigger.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["browsers","desktop","firefox","runtime"],"not_affected_if":["firefox-159-or-later"],"how_to_check":"- Run `firefox --version` and compare against the fixed release.\n- Check Help > About Firefox in the browser to confirm the installed version.","fix":"- Update Firefox to `159` or later.","status":"open","published_at":"2026-10-27T14:16:58+00:00","first_seen_at":"2026-10-27T14:32:25+00:00","triaged_at":"2026-10-27T14:33:38+00:00","updated_at":"2026-10-27T14:33:38+00:00","category":"runtime","confidence":0.5,"triage":{"at":"2026-10-27T14:33:38Z","model":"claude-haiku-5-5","output":{"fix":"- Update Firefox to `159` or later.","reach":"unknown","title":"Firefox: use-after-free in WebRTC signaling enables privilege escalation","impact":"high","summary":"A use-after-free bug in the WebRTC signaling component of Firefox lets code reuse freed memory. The sources say this leads to privilege escalation, but they give no detail on the exact trigger.","category":"runtime","nicknames":[],"who_cares":["firefox","browsers","desktop"],"confidence":0.5,"needs_auth":"unknown","worst_case":"attacker escalates privileges inside the browser process","analyst_note":"Confirm the affected version range and whether exploitation needs a crafted web page, via the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-118006 or the Mozilla advisory for Firefox 159.","how_to_check":"- Run `firefox --version` and compare against the fixed release.\n- Check Help > About Firefox in the browser to confirm the installed version.","needs_analyst":true,"not_affected_if":["firefox-159-or-later"],"who_is_affected":"Anyone running Firefox builds older than version 159 on a desktop or device. The sources do not say whether specific configurations or WebRTC usage are required to be exposed.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000567,"input_tokens":3245,"output_tokens":485,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-118006':14A,17A '-2026':13A,16A '159':76C 'browser':18B 'bug':27B 'code':36B 'compon':32B,69C 'cve':12A,15A 'desktop':19B 'detail':52B 'due':59C 'enabl':9A 'escal':11A,47B,58C 'exact':55B 'firefox':1A,20B,34B,75C 'fix':73C 'free':5A,26B,64C 'freed':38B 'give':50B 'lead':44B 'let':35B 'memori':39B 'privileg':10A,46B,57C 'reus':37B 'runtim':21B 'say':42B 'signal':8A,31B,68C 'sourc':41B 'trigger':56B 'use':3A,24B,62C 'use-after-fre':2A,23B,61C 'vulner':71C 'webrtc':7A,30B,67C","nicknames":[],"mitigations":[],"who_affected":"Anyone running Firefox builds older than version 159 on a desktop or device. The sources do not say whether specific configurations or WebRTC usage are required to be exposed.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-27T14:16:58+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-118006","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118006","severity":null,"published_at":"2026-10-27T14:16:58+00:00","modified_at":"2026-10-27T14:16:58+00:00","first_seen_at":"2026-10-27T14:32:25+00:00","fetched_at":"2026-10-27T14:32:25+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}