Live › vulnerability › CVE-2026-118007
Go to dashboardA use-after-free bug in the JavaScript garbage collector of Firefox can corrupt memory when the browser runs certain scripts. The sources do not say what an attacker can achieve beyond that, and the description says the issue was fixed in Firefox 159.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-27 14:32 UTC. All times on this page are UTC.
Anyone running Firefox older than version 159 is affected, since the flaw is in the browser's JavaScript engine. The sources do not say which configurations or sites are needed to trigger it, so unknown whether any group can skip the update.
No product ranges from the sources yet.
Help > About Firefox in the browser and compare the version with 159.159 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Use-after-free in the JavaScript: GC component. This vulnerability was fixed in Firefox 159.
This page as .md · .json · in your agent: get_signal("CVE-2026-118007")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.