---
id: "CVE-2026-118016"
kind: "vulnerability"
aliases: ["CVE-2026-118016"]
title: "Firefox: use-after-free in DOM core and HTML lets attackers run code"
severity: "unknown"
cvss: null
epss: null
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["browsers", "desktop", "firefox", "runtime"]
not_affected_if: ["firefox-159-or-later"]
published_at: "2026-10-27T14:16:59+00:00"
first_seen_at: "2026-10-27T14:32:25+00:00"
updated_at: "2026-10-27T14:33:28+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-118016", "first_seen_at": "2026-10-27T14:32:25+00:00"}]
---

# Firefox: use-after-free in DOM core and HTML lets attackers run code

A use-after-free bug in Firefox's DOM Core and HTML component lets memory be reused after it is freed. The sources do not say what an attacker can do beyond that, and the fix ships in Firefox 159.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Firefox version in the browser's About page or with `firefox --version`, and compare it to `159`.
- unknown for anything beyond the version check, since the sources do not say.

## Fix

- Update Firefox to `159` or later.

## Timeline

- 2026-10-27T14:32:25+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-118016

## From the sources

Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 159.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_