---
id: "CVE-2026-118012"
kind: "vulnerability"
aliases: ["CVE-2026-118012"]
title: "Firefox: use-after-free in DOM Animation component fixed in 159"
severity: "unknown"
cvss: null
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["desktop-browsers", "firefox", "other"]
not_affected_if: ["firefox-159-or-later"]
published_at: "2026-10-27T14:16:59+00:00"
first_seen_at: "2026-10-27T14:32:25+00:00"
updated_at: "2026-10-27T14:33:32+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-118012", "first_seen_at": "2026-10-27T14:32:25+00:00"}]
---

# Firefox: use-after-free in DOM Animation component fixed in 159

A use-after-free bug exists in the DOM Animation component of Firefox. The sources do not say what an attacker gets from triggering it, and the advisory only states it was fixed in Firefox 159.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Firefox version (Help > About Firefox, or `firefox --version`) and compare it to `159`.

## Fix

- Update Firefox to `159` or later.

## Timeline

- 2026-10-27T14:32:25+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-118012

## From the sources

Use-after-free in the DOM: Animation component. This vulnerability was fixed in Firefox 159.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_