{"id":"CVE-2026-118020","kind":"vulnerability","aliases":["CVE-2026-118020"],"related":[],"title":"Firefox: use-after-free in Layout component can be exploited","description":"Use-after-free in the Layout component. This vulnerability was fixed in Firefox 159.","summary":"A use-after-free bug in Firefox's Layout component lets memory be reused after it is freed. The sources do not say what an attacker can gain beyond that, so the impact is not confirmed.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["desktop","firefox","other"],"not_affected_if":["firefox-159-or-later"],"how_to_check":"- Run `firefox --version` or open About Firefox to see the installed version\n- Compare the result with the fixed release named in the sources","fix":"- Update Firefox to version `159` or later","status":"open","published_at":"2026-10-27T14:16:59+00:00","first_seen_at":"2026-10-27T14:32:25+00:00","triaged_at":"2026-10-27T14:33:24+00:00","updated_at":"2026-10-27T14:33:24+00:00","category":"other","confidence":0.5,"triage":{"at":"2026-10-27T14:33:24Z","model":"claude-haiku-5-5","output":{"fix":"- Update Firefox to version `159` or later","reach":"unknown","title":"Firefox: use-after-free in Layout component can be exploited","impact":"medium","summary":"A use-after-free bug in Firefox's Layout component lets memory be reused after it is freed. The sources do not say what an attacker can gain beyond that, so the impact is not confirmed.","category":"other","nicknames":[],"who_cares":["firefox","desktop"],"confidence":0.5,"needs_auth":"unknown","worst_case":"unknown","analyst_note":"Check the NVD entry and Mozilla's advisory for the trigger, attack vector and whether memory corruption is exploitable beyond a crash.","how_to_check":"- Run `firefox --version` or open About Firefox to see the installed version\n- Compare the result with the fixed release named in the sources","needs_analyst":true,"not_affected_if":["firefox-159-or-later"],"who_is_affected":"Teams whose staff or systems run Firefox earlier than version 159 are affected. The sources do not say which configurations or content paths trigger the bug, so the exact exposure is unknown.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000536,"input_tokens":3215,"output_tokens":430,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-118020':14A,17A '-2026':13A,16A '159':71C 'attack':46B 'beyond':49B 'bug':25B 'compon':8A,30B,64C 'confirm':56B 'cve':12A,15A 'desktop':18B 'exploit':11A 'firefox':1A,19B,27B,70C 'fix':68C 'free':5A,24B,60C 'freed':38B 'gain':48B 'impact':53B 'layout':7A,29B,63C 'let':31B 'memori':32B 'reus':34B 'say':43B 'sourc':40B 'use':3A,22B,58C 'use-after-fre':2A,21B,57C 'vulner':66C","nicknames":[],"mitigations":[],"who_affected":"Teams whose staff or systems run Firefox earlier than version 159 are affected. The sources do not say which configurations or content paths trigger the bug, so the exact exposure is unknown.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-27T14:16:59+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-118020","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118020","severity":null,"published_at":"2026-10-27T14:16:59+00:00","modified_at":"2026-10-27T14:16:59+00:00","first_seen_at":"2026-10-27T14:32:25+00:00","fetched_at":"2026-10-27T14:32:25+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}