{"id":"CVE-2026-118012","kind":"vulnerability","aliases":["CVE-2026-118012"],"related":[],"title":"Firefox: use-after-free in DOM Animation component fixed in 159","description":"Use-after-free in the DOM: Animation component. This vulnerability was fixed in Firefox 159.","summary":"A use-after-free bug exists in the DOM Animation component of Firefox. The sources do not say what an attacker gets from triggering it, and the advisory only states it was fixed in Firefox 159.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["desktop-browsers","firefox","other"],"not_affected_if":["firefox-159-or-later"],"how_to_check":"- Check the installed Firefox version (Help > About Firefox, or `firefox --version`) and compare it to `159`.","fix":"- Update Firefox to `159` or later.","status":"open","published_at":"2026-10-27T14:16:59+00:00","first_seen_at":"2026-10-27T14:32:25+00:00","triaged_at":"2026-10-27T14:33:32+00:00","updated_at":"2026-10-27T14:33:32+00:00","category":"other","confidence":0.4,"triage":{"at":"2026-10-27T14:33:32Z","model":"claude-haiku-5-5","output":{"fix":"- Update Firefox to `159` or later.","reach":"unknown","title":"Firefox: use-after-free in DOM Animation component fixed in 159","impact":"high","summary":"A use-after-free bug exists in the DOM Animation component of Firefox. The sources do not say what an attacker gets from triggering it, and the advisory only states it was fixed in Firefox 159.","category":"other","nicknames":[],"who_cares":["firefox","desktop-browsers"],"confidence":0.4,"needs_auth":"unknown","worst_case":"unknown; use-after-free may allow memory corruption or code execution","analyst_note":"Check the Mozilla security advisory for this CVE to confirm impact, triggering conditions and whether it is exploited; the NVD entry gave no detail.","how_to_check":"- Check the installed Firefox version (Help > About Firefox, or `firefox --version`) and compare it to `159`.","needs_analyst":true,"not_affected_if":["firefox-159-or-later"],"who_is_affected":"Anyone running Firefox older than version 159. The sources do not describe the triggering conditions, so whether a page or only local use is needed is unknown.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000545,"input_tokens":3223,"output_tokens":445,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-118012':15A,18A '-2026':14A,17A '159':12A,59B,75C 'advisori':51B 'anim':8A,33B,67C 'attack':44B 'browser':21B 'bug':28B 'compon':9A,34B,68C 'cve':13A,16A 'desktop':20B 'desktop-brows':19B 'dom':7A,32B,66C 'exist':29B 'firefox':1A,22B,36B,58B,74C 'fix':10A,56B,72C 'free':5A,27B,63C 'get':45B 'say':41B 'sourc':38B 'state':53B 'trigger':47B 'use':3A,25B,61C 'use-after-fre':2A,24B,60C 'vulner':70C","nicknames":[],"mitigations":[],"who_affected":"Anyone running Firefox older than version 159. The sources do not describe the triggering conditions, so whether a page or only local use is needed is unknown.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-27T14:16:59+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-118012","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118012","severity":null,"published_at":"2026-10-27T14:16:59+00:00","modified_at":"2026-10-27T14:16:59+00:00","first_seen_at":"2026-10-27T14:32:25+00:00","fetched_at":"2026-10-27T14:32:25+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}