---
id: "CVE-2026-118006"
kind: "vulnerability"
aliases: ["CVE-2026-118006"]
title: "Firefox: use-after-free in WebRTC signaling enables privilege escalation"
severity: "unknown"
cvss: null
epss: null
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["browsers", "desktop", "firefox", "runtime"]
not_affected_if: ["firefox-159-or-later"]
published_at: "2026-10-27T14:16:58+00:00"
first_seen_at: "2026-10-27T14:32:25+00:00"
updated_at: "2026-10-27T14:33:38+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-118006", "first_seen_at": "2026-10-27T14:32:25+00:00"}]
---

# Firefox: use-after-free in WebRTC signaling enables privilege escalation

A use-after-free bug in the WebRTC signaling component of Firefox lets code reuse freed memory. The sources say this leads to privilege escalation, but they give no detail on the exact trigger.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Run `firefox --version` and compare against the fixed release.
- Check Help > About Firefox in the browser to confirm the installed version.

## Fix

- Update Firefox to `159` or later.

## Timeline

- 2026-10-27T14:32:25+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-118006

## From the sources

Privilege escalation due to use-after-free in the WebRTC: Signaling component. This vulnerability was fixed in Firefox 159.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_