Live › vulnerability › CVE-2026-118015
Go to dashboardFirefox has a use-after-free bug in its DOM Core and HTML component, where memory is used after it has been freed. The sources do not say what an attacker can get from it, beyond that it was fixed in Firefox 159.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-27 14:32 UTC. All times on this page are UTC.
Anyone running Firefox builds older than version 159 is likely exposed, since the fix shipped in 159. The sources do not say which earlier versions are affected, whether exploitation requires a crafted web page, or which deployments are most at risk. unknown for the rest.
No product ranges from the sources yet.
firefox --version or check Help > About Firefox and compare against 159159 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 159.
This page as .md · .json · in your agent: get_signal("CVE-2026-118015")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.