{"id":"CVE-2026-118016","kind":"vulnerability","aliases":["CVE-2026-118016"],"related":[],"title":"Firefox: use-after-free in DOM core and HTML lets attackers run code","description":"Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 159.","summary":"A use-after-free bug in Firefox's DOM Core and HTML component lets memory be reused after it is freed. The sources do not say what an attacker can do beyond that, and the fix ships in Firefox 159.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["browsers","desktop","firefox","runtime"],"not_affected_if":["firefox-159-or-later"],"how_to_check":"- Check the installed Firefox version in the browser's About page or with `firefox --version`, and compare it to `159`.\n- unknown for anything beyond the version check, since the sources do not say.","fix":"- Update Firefox to `159` or later.","status":"open","published_at":"2026-10-27T14:16:59+00:00","first_seen_at":"2026-10-27T14:32:25+00:00","triaged_at":"2026-10-27T14:33:28+00:00","updated_at":"2026-10-27T14:33:28+00:00","category":"runtime","confidence":0.5,"triage":{"at":"2026-10-27T14:33:28Z","model":"claude-haiku-5-5","output":{"fix":"- Update Firefox to `159` or later.","reach":"unknown","title":"Firefox: use-after-free in DOM core and HTML lets attackers run code","impact":"high","summary":"A use-after-free bug in Firefox's DOM Core and HTML component lets memory be reused after it is freed. The sources do not say what an attacker can do beyond that, and the fix ships in Firefox 159.","category":"runtime","nicknames":[],"who_cares":["firefox","browsers","desktop"],"confidence":0.5,"needs_auth":"unknown","worst_case":"unknown; memory corruption could allow code execution","analyst_note":"Check the Mozilla security advisory for the Firefox 159 release to confirm the exploit conditions, impact and whether it is exploited in the wild, using the NVD entry linked in sources.","how_to_check":"- Check the installed Firefox version in the browser's About page or with `firefox --version`, and compare it to `159`.\n- unknown for anything beyond the version check, since the sources do not say.","needs_analyst":true,"not_affected_if":["firefox-159-or-later"],"who_is_affected":"Anyone running Firefox older than version 159 is likely exposed, since the sources say the flaw was fixed in that release. The sources do not say which configurations or content are needed to trigger it, so unknown beyond that.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000574,"input_tokens":3229,"output_tokens":503,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-118016':17A,20A '-2026':16A,19A '159':65B,82C 'attack':12A,54B 'beyond':57B 'browser':21B 'bug':30B 'code':14A 'compon':38B,75C 'core':8A,35B,73C 'cve':15A,18A 'desktop':22B 'dom':7A,34B,72C 'firefox':1A,23B,32B,64B,81C 'fix':61B,79C 'free':5A,29B,69C 'freed':46B 'html':10A,37B,74C 'let':11A,39B 'memori':40B 'reus':42B 'run':13A 'runtim':24B 'say':51B 'ship':62B 'sourc':48B 'use':3A,27B,67C 'use-after-fre':2A,26B,66C 'vulner':77C","nicknames":[],"mitigations":[],"who_affected":"Anyone running Firefox older than version 159 is likely exposed, since the sources say the flaw was fixed in that release. The sources do not say which configurations or content are needed to trigger it, so unknown beyond that.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-27T14:16:59+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-118016","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118016","severity":null,"published_at":"2026-10-27T14:16:59+00:00","modified_at":"2026-10-27T14:16:59+00:00","first_seen_at":"2026-10-27T14:32:25+00:00","fetched_at":"2026-10-27T14:32:25+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}