{"id":"CVE-2026-118015","kind":"vulnerability","aliases":["CVE-2026-118015"],"related":[],"title":"Firefox: use-after-free in DOM core and HTML lets attackers run code","description":"Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 159.","summary":"Firefox has a use-after-free bug in its DOM Core and HTML component, where memory is used after it has been freed. The sources do not say what an attacker can get from it, beyond that it was fixed in Firefox 159.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["desktop-browsers","firefox","other"],"not_affected_if":["firefox-159-or-later"],"how_to_check":"- Run `firefox --version` or check Help > About Firefox and compare against `159`\n- unknown for anything more specific, since the sources do not say which earlier versions are affected","fix":"- Update Firefox to `159` or later\n- unknown for other mitigations, since the sources do not say","status":"open","published_at":"2026-10-27T14:16:59+00:00","first_seen_at":"2026-10-27T14:32:25+00:00","triaged_at":"2026-10-27T14:33:30+00:00","updated_at":"2026-10-27T14:33:30+00:00","category":"other","confidence":0.35,"triage":{"at":"2026-10-27T14:33:30Z","model":"claude-haiku-5-5","output":{"fix":"- Update Firefox to `159` or later\n- unknown for other mitigations, since the sources do not say","reach":"unknown","title":"Firefox: use-after-free in DOM core and HTML lets attackers run code","impact":"medium","summary":"Firefox has a use-after-free bug in its DOM Core and HTML component, where memory is used after it has been freed. The sources do not say what an attacker can get from it, beyond that it was fixed in Firefox 159.","category":"other","nicknames":[],"who_cares":["firefox","desktop-browsers"],"confidence":0.35,"needs_auth":"unknown","worst_case":"unknown; memory corruption in the browser, exploitability not stated","analyst_note":"Check the Mozilla security advisory for Firefox 159 and the Bugzilla entry to learn affected versions, exploitability and whether it is reachable from web content.","how_to_check":"- Run `firefox --version` or check Help > About Firefox and compare against `159`\n- unknown for anything more specific, since the sources do not say which earlier versions are affected","needs_analyst":true,"not_affected_if":["firefox-159-or-later"],"who_is_affected":"Anyone running Firefox builds older than version 159 is likely exposed, since the fix shipped in 159. The sources do not say which earlier versions are affected, whether exploitation requires a crafted web page, or which deployments are most at risk. unknown for the rest.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000589,"input_tokens":3229,"output_tokens":532,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-118015':17A,20A '-2026':16A,19A '159':68B,85C 'attack':12A,56B 'beyond':61B 'browser':23B 'bug':32B 'code':14A 'compon':39B,78C 'core':8A,36B,76C 'cve':15A,18A 'desktop':22B 'desktop-brows':21B 'dom':7A,35B,75C 'firefox':1A,24B,25B,67B,84C 'fix':65B,82C 'free':5A,31B,72C 'freed':48B 'get':58B 'html':10A,38B,77C 'let':11A 'memori':41B 'run':13A 'say':53B 'sourc':50B 'use':3A,29B,43B,70C 'use-after-fre':2A,28B,69C 'vulner':80C","nicknames":[],"mitigations":[],"who_affected":"Anyone running Firefox builds older than version 159 is likely exposed, since the fix shipped in 159. The sources do not say which earlier versions are affected, whether exploitation requires a crafted web page, or which deployments are most at risk. unknown for the rest.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-27T14:16:59+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-118015","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118015","severity":null,"published_at":"2026-10-27T14:16:59+00:00","modified_at":"2026-10-27T14:16:59+00:00","first_seen_at":"2026-10-27T14:32:25+00:00","fetched_at":"2026-10-27T14:32:25+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}