---
id: "CVE-2026-118015"
kind: "vulnerability"
aliases: ["CVE-2026-118015"]
title: "Firefox: use-after-free in DOM core and HTML lets attackers run code"
severity: "unknown"
cvss: null
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["desktop-browsers", "firefox", "other"]
not_affected_if: ["firefox-159-or-later"]
published_at: "2026-10-27T14:16:59+00:00"
first_seen_at: "2026-10-27T14:32:25+00:00"
updated_at: "2026-10-27T14:33:30+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-118015", "first_seen_at": "2026-10-27T14:32:25+00:00"}]
---

# Firefox: use-after-free in DOM core and HTML lets attackers run code

Firefox has a use-after-free bug in its DOM Core and HTML component, where memory is used after it has been freed. The sources do not say what an attacker can get from it, beyond that it was fixed in Firefox 159.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Run `firefox --version` or check Help > About Firefox and compare against `159`
- unknown for anything more specific, since the sources do not say which earlier versions are affected

## Fix

- Update Firefox to `159` or later
- unknown for other mitigations, since the sources do not say

## Timeline

- 2026-10-27T14:32:25+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-118015

## From the sources

Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 159.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_