---
id: "CVE-2026-118020"
kind: "vulnerability"
aliases: ["CVE-2026-118020"]
title: "Firefox: use-after-free in Layout component can be exploited"
severity: "unknown"
cvss: null
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["desktop", "firefox", "other"]
not_affected_if: ["firefox-159-or-later"]
published_at: "2026-10-27T14:16:59+00:00"
first_seen_at: "2026-10-27T14:32:25+00:00"
updated_at: "2026-10-27T14:33:24+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-118020", "first_seen_at": "2026-10-27T14:32:25+00:00"}]
---

# Firefox: use-after-free in Layout component can be exploited

A use-after-free bug in Firefox's Layout component lets memory be reused after it is freed. The sources do not say what an attacker can gain beyond that, so the impact is not confirmed.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Run `firefox --version` or open About Firefox to see the installed version
- Compare the result with the fixed release named in the sources

## Fix

- Update Firefox to version `159` or later

## Timeline

- 2026-10-27T14:32:25+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-118020

## From the sources

Use-after-free in the Layout component. This vulnerability was fixed in Firefox 159.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_