{"id":"CVE-2026-118014","kind":"vulnerability","aliases":["CVE-2026-118014"],"related":[],"title":"Firefox: JavaScript JIT use-after-free can be triggered by crafted script","description":"Use-after-free in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 159.","summary":"A use-after-free bug in the JIT compiler of Firefox's JavaScript engine lets memory be reused after it is freed. Per the sources it was fixed in Firefox 159; the sources do not state what an attacker can gain beyond that.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["browser","firefox","runtime"],"not_affected_if":["firefox-159-or-later"],"how_to_check":"- Check the installed Firefox version (`firefox --version`) and compare it with `159`\n- unknown whether the sources list any other check","fix":"- Update Firefox to `159` or later\n- unknown whether the sources name any other action","status":"open","published_at":"2026-10-27T14:16:59+00:00","first_seen_at":"2026-10-27T14:32:25+00:00","triaged_at":"2026-10-27T14:33:31+00:00","updated_at":"2026-10-27T14:33:31+00:00","category":"runtime","confidence":0.4,"triage":{"at":"2026-10-27T14:33:31Z","model":"claude-haiku-5-5","output":{"fix":"- Update Firefox to `159` or later\n- unknown whether the sources name any other action","reach":"internet","title":"Firefox: JavaScript JIT use-after-free can be triggered by crafted script","impact":"high","summary":"A use-after-free bug in the JIT compiler of Firefox's JavaScript engine lets memory be reused after it is freed. Per the sources it was fixed in Firefox 159; the sources do not state what an attacker can gain beyond that.","category":"runtime","nicknames":[],"who_cares":["firefox","browser"],"confidence":0.4,"needs_auth":"unknown","worst_case":"unknown, sources do not state the impact","analyst_note":"Check the Mozilla security advisory for this CVE to confirm the impact, whether it is exploited, and the exact affected versions (https://nvd.nist.gov/vuln/detail/CVE-2026-118014).","how_to_check":"- Check the installed Firefox version (`firefox --version`) and compare it with `159`\n- unknown whether the sources list any other check","needs_analyst":true,"not_affected_if":["firefox-159-or-later"],"who_is_affected":"Anyone running Firefox older than 159 is likely exposed, since the flaw is in the browser's JavaScript JIT component that runs web page scripts. The sources do not say which platforms or configurations are affected beyond that, or whether the bug is reachable without user interaction.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000589,"input_tokens":3233,"output_tokens":531,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-118014':16A,19A '-2026':15A,18A '159':54B,82C 'attack':62B 'beyond':65B 'browser':20B 'bug':28B 'compil':32B 'compon':75C 'craft':12A 'cve':14A,17A 'engin':37B,73C 'firefox':1A,21B,34B,53B,81C 'fix':51B,79C 'free':7A,27B,69C 'freed':45B 'gain':64B 'javascript':2A,36B,72C 'jit':3A,31B,74C 'let':38B 'memori':39B 'per':46B 'reus':41B 'runtim':22B 'script':13A 'sourc':48B,56B 'state':59B 'trigger':10A 'use':5A,25B,67C 'use-after-fre':4A,24B,66C 'vulner':77C","nicknames":[],"mitigations":[],"who_affected":"Anyone running Firefox older than 159 is likely exposed, since the flaw is in the browser's JavaScript JIT component that runs web page scripts. The sources do not say which platforms or configurations are affected beyond that, or whether the bug is reachable without user interaction.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-27T14:16:59+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-118014","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118014","severity":null,"published_at":"2026-10-27T14:16:59+00:00","modified_at":"2026-10-27T14:16:59+00:00","first_seen_at":"2026-10-27T14:32:25+00:00","fetched_at":"2026-10-27T14:32:25+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}