{"id":"CVE-2026-118023","kind":"vulnerability","aliases":["CVE-2026-118023"],"related":[],"title":"Firefox: use-after-free in WebRender lets content escape the sandbox","description":"Sandbox escape due to use-after-free in the Graphics: WebRender component. This vulnerability was fixed in Firefox 159.","summary":"A use-after-free bug in the WebRender graphics component of Firefox allows an attacker to escape the browser sandbox. The sources describe it as fixed in Firefox 159 and do not say what an attacker can reach after escaping.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["browsers","desktop","firefox","other"],"not_affected_if":["already-updated-to-159"],"how_to_check":"- Run `firefox --version` or open the About Firefox page and compare the version against `159`\n- unknown","fix":"- Update Firefox to `159` or later\n- unknown","status":"open","published_at":"2026-10-27T14:17:00+00:00","first_seen_at":"2026-10-27T14:32:25+00:00","triaged_at":"2026-10-27T14:33:22+00:00","updated_at":"2026-10-27T14:33:22+00:00","category":"other","confidence":0.5,"triage":{"at":"2026-10-27T14:33:22Z","model":"claude-haiku-5-5","output":{"fix":"- Update Firefox to `159` or later\n- unknown","reach":"unknown","title":"Firefox: use-after-free in WebRender lets content escape the sandbox","impact":"high","summary":"A use-after-free bug in the WebRender graphics component of Firefox allows an attacker to escape the browser sandbox. The sources describe it as fixed in Firefox 159 and do not say what an attacker can reach after escaping.","category":"other","nicknames":[],"who_cares":["firefox","desktop","browsers"],"confidence":0.5,"needs_auth":"unknown","worst_case":"Attacker escapes browser sandbox and runs code outside it","analyst_note":"Check Mozilla's Firefox 159 security advisory for affected ESR branches, the trigger conditions and whether it is exploited in the wild; the NVD entry has no CVSS or detail.","how_to_check":"- Run `firefox --version` or open the About Firefox page and compare the version against `159`\n- unknown","needs_analyst":true,"not_affected_if":["already-updated-to-159"],"who_is_affected":"Anyone running Firefox builds older than 159 is likely affected, since the sources say the flaw was fixed in that release. Systems on managed Firefox ESR or other distributions may ship the fix on a different schedule, and the sources do not say which builds are affected. unknown","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000578,"input_tokens":3243,"output_tokens":508,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-118023':15A,18A '-2026':14A,17A '159':51B,82C 'allow':35B 'attack':37B,58B 'browser':19B,41B 'bug':27B 'compon':32B,75C 'content':9A 'cve':13A,16A 'describ':45B 'desktop':20B 'due':65C 'escap':10A,39B,62B,64C 'firefox':1A,21B,34B,50B,81C 'fix':48B,79C 'free':5A,26B,70C 'graphic':31B,73C 'let':8A 'reach':60B 'sandbox':12A,42B,63C 'say':55B 'sourc':44B 'use':3A,24B,68C 'use-after-fre':2A,23B,67C 'vulner':77C 'webrend':7A,30B,74C","nicknames":[],"mitigations":[],"who_affected":"Anyone running Firefox builds older than 159 is likely affected, since the sources say the flaw was fixed in that release. Systems on managed Firefox ESR or other distributions may ship the fix on a different schedule, and the sources do not say which builds are affected. unknown","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-27T14:17:00+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-118023","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118023","severity":null,"published_at":"2026-10-27T14:17:00+00:00","modified_at":"2026-10-27T14:17:00+00:00","first_seen_at":"2026-10-27T14:32:25+00:00","fetched_at":"2026-10-27T14:32:25+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}