Live › vulnerability › CVE-2026-118022
Go to dashboardA use-after-free bug in the Disability Access APIs component of Firefox allows a sandbox escape. An attacker who can run content in the browser could break out of the renderer sandbox.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-27 14:32 UTC. All times on this page are UTC.
Anyone running Firefox builds before 159 is potentially exposed, since the flaw is in the browser itself rather than a server component. Systems that have already moved to Firefox 159 or later are not affected. Sources do not say whether ESR branches are covered by the same fix version.
No product ranges from the sources yet.
firefox --version or Help > About Firefox; versions below 159 are affected per the description.159 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Sandbox escape due to use-after-free in the Disability Access APIs component. This vulnerability was fixed in Firefox 159.
This page as .md · .json · in your agent: get_signal("CVE-2026-118022")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.