{"id":"CVE-2026-118021","kind":"vulnerability","aliases":["CVE-2026-118021"],"related":[],"title":"Firefox: use-after-free in XPCOM lets web content escape the sandbox","description":"Sandbox escape due to use-after-free in the XPCOM component. This vulnerability was fixed in Firefox 159.","summary":"A use-after-free bug in Firefox's XPCOM component allows a sandbox escape. The sources do not say what an attacker gains beyond leaving the sandbox.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["browsers","desktop","firefox","runtime"],"not_affected_if":["firefox-159-or-later"],"how_to_check":"- Run `firefox --version` or open About Firefox and compare against `159`\n- Check the Firefox version bundled by your managed browser or deployment tooling; the sources do not name other affected versions","fix":"- Update Firefox to `159` or later\n- unknown for other products or ESR branches, the sources do not say","status":"open","published_at":"2026-10-27T14:16:59+00:00","first_seen_at":"2026-10-27T14:32:25+00:00","triaged_at":"2026-10-27T14:33:23+00:00","updated_at":"2026-10-27T14:33:23+00:00","category":"runtime","confidence":0.5,"triage":{"at":"2026-10-27T14:33:23Z","model":"claude-haiku-5-5","output":{"fix":"- Update Firefox to `159` or later\n- unknown for other products or ESR branches, the sources do not say","reach":"internet","title":"Firefox: use-after-free in XPCOM lets web content escape the sandbox","impact":"high","summary":"A use-after-free bug in Firefox's XPCOM component allows a sandbox escape. The sources do not say what an attacker gains beyond leaving the sandbox.","category":"runtime","nicknames":[],"who_cares":["firefox","desktop","browsers"],"confidence":0.5,"needs_auth":"unknown","worst_case":"unknown; sandbox escape from browser content, further impact not stated","analyst_note":"Check the Mozilla security advisory for CVE-2026-118021 for severity, ESR affected versions, and whether the bug is reachable from web content without user interaction.","how_to_check":"- Run `firefox --version` or open About Firefox and compare against `159`\n- Check the Firefox version bundled by your managed browser or deployment tooling; the sources do not name other affected versions","needs_analyst":true,"not_affected_if":["firefox-159-or-later"],"who_is_affected":"Teams that run or ship Firefox builds older than version 159, including managed desktops and kiosks where users browse untrusted sites. The sources do not say whether ESR branches or other Mozilla products are affected, so unknown for those. Teams that only run Firefox on fully updated builds can skip it.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000592,"input_tokens":3235,"output_tokens":537,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-118021':16A,19A '-2026':15A,18A '159':70C 'allow':35B 'attack':46B 'beyond':48B 'browser':20B 'bug':29B 'compon':34B,63C 'content':10A 'cve':14A,17A 'desktop':21B 'due':54C 'escap':11A,38B,53C 'firefox':1A,22B,31B,69C 'fix':67C 'free':5A,28B,59C 'gain':47B 'leav':49B 'let':8A 'runtim':23B 'sandbox':13A,37B,51B,52C 'say':43B 'sourc':40B 'use':3A,26B,57C 'use-after-fre':2A,25B,56C 'vulner':65C 'web':9A 'xpcom':7A,33B,62C","nicknames":[],"mitigations":[],"who_affected":"Teams that run or ship Firefox builds older than version 159, including managed desktops and kiosks where users browse untrusted sites. The sources do not say whether ESR branches or other Mozilla products are affected, so unknown for those. Teams that only run Firefox on fully updated builds can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-27T14:16:59+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-118021","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118021","severity":null,"published_at":"2026-10-27T14:16:59+00:00","modified_at":"2026-10-27T14:16:59+00:00","first_seen_at":"2026-10-27T14:32:25+00:00","fetched_at":"2026-10-27T14:32:25+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}