---
id: "CVE-2026-118023"
kind: "vulnerability"
aliases: ["CVE-2026-118023"]
title: "Firefox: use-after-free in WebRender lets content escape the sandbox"
severity: "unknown"
cvss: null
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["browsers", "desktop", "firefox", "other"]
not_affected_if: ["already-updated-to-159"]
published_at: "2026-10-27T14:17:00+00:00"
first_seen_at: "2026-10-27T14:32:25+00:00"
updated_at: "2026-10-27T14:33:22+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-118023", "first_seen_at": "2026-10-27T14:32:25+00:00"}]
---

# Firefox: use-after-free in WebRender lets content escape the sandbox

A use-after-free bug in the WebRender graphics component of Firefox allows an attacker to escape the browser sandbox. The sources describe it as fixed in Firefox 159 and do not say what an attacker can reach after escaping.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Run `firefox --version` or open the About Firefox page and compare the version against `159`
- unknown

## Fix

- Update Firefox to `159` or later
- unknown

## Timeline

- 2026-10-27T14:32:25+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-118023

## From the sources

Sandbox escape due to use-after-free in the Graphics: WebRender component. This vulnerability was fixed in Firefox 159.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_