{"id":"CVE-2026-118010","kind":"vulnerability","aliases":["CVE-2026-118010"],"related":[],"title":"Firefox: use-after-free in Disability Access APIs component fixed in 159","description":"Use-after-free in the Disability Access APIs component. This vulnerability was fixed in Firefox 159.","summary":"A use-after-free bug in the Disability Access APIs component of Firefox could cause memory corruption when a page triggers it. The sources do not state what an attacker can achieve beyond that.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["browser","desktop","firefox","other"],"not_affected_if":["firefox-159-or-later"],"how_to_check":"- Check the installed Firefox version in the browser's About page or with `firefox --version`; versions below `159` include the flaw.","fix":"- Update Firefox to `159` or later.","status":"open","published_at":"2026-10-27T14:16:58+00:00","first_seen_at":"2026-10-27T14:32:25+00:00","triaged_at":"2026-10-27T14:33:34+00:00","updated_at":"2026-10-27T14:33:34+00:00","category":"other","confidence":0.4,"triage":{"at":"2026-10-27T14:33:34Z","model":"claude-haiku-5-5","output":{"fix":"- Update Firefox to `159` or later.","reach":"unknown","title":"Firefox: use-after-free in Disability Access APIs component fixed in 159","impact":"medium","summary":"A use-after-free bug in the Disability Access APIs component of Firefox could cause memory corruption when a page triggers it. The sources do not state what an attacker can achieve beyond that.","category":"other","nicknames":[],"who_cares":["firefox","browser","desktop"],"confidence":0.4,"needs_auth":"unknown","worst_case":"unknown; memory corruption in the browser, exploitability not stated","analyst_note":"Check the Mozilla security advisory for the Firefox 159 release to learn the exploit conditions and whether it is exploited in the wild.","how_to_check":"- Check the installed Firefox version in the browser's About page or with `firefox --version`; versions below `159` include the flaw.","needs_analyst":true,"not_affected_if":["firefox-159-or-later"],"who_is_affected":"Anyone running Firefox older than version 159 is affected, since the flaw is in the browser itself. Teams that do not use Firefox on their machines or servers can skip it. The sources do not say whether a malicious web page alone is enough to trigger it.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000558,"input_tokens":3225,"output_tokens":471,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-118010':16A,19A '-2026':15A,18A '159':13A,73C 'access':8A,32B,64C 'achiev':55B 'api':9A,33B,65C 'attack':53B 'beyond':56B 'browser':20B 'bug':28B 'caus':38B 'compon':10A,34B,66C 'corrupt':40B 'could':37B 'cve':14A,17A 'desktop':21B 'disabl':7A,31B,63C 'firefox':1A,22B,36B,72C 'fix':11A,70C 'free':5A,27B,60C 'memori':39B 'page':43B 'sourc':47B 'state':50B 'trigger':44B 'use':3A,25B,58C 'use-after-fre':2A,24B,57C 'vulner':68C","nicknames":[],"mitigations":[],"who_affected":"Anyone running Firefox older than version 159 is affected, since the flaw is in the browser itself. Teams that do not use Firefox on their machines or servers can skip it. The sources do not say whether a malicious web page alone is enough to trigger it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-27T14:16:58+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-118010","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118010","severity":null,"published_at":"2026-10-27T14:16:58+00:00","modified_at":"2026-10-27T14:16:58+00:00","first_seen_at":"2026-10-27T14:32:25+00:00","fetched_at":"2026-10-27T14:32:25+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}