Live › vulnerability › CVE-2026-118026
Go to dashboardFirefox's JavaScript garbage collector can use an invalid pointer, a memory-safety bug. The sources do not say what an attacker can achieve beyond that, so the impact is unconfirmed.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-27 14:32 UTC. All times on this page are UTC.
Anyone running Firefox before version 159 is in scope, since the flaw is in the browser's JavaScript engine that runs every web page. Servers and build pipelines that do not run a desktop browser are unlikely to be exposed. The sources do not say whether specific configurations are safer.
No product ranges from the sources yet.
Help > About Firefox in the browser shows the installed version; a version below 159 is affected159 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Invalid pointer in the JavaScript: GC component. This vulnerability was fixed in Firefox 159.
This page as .md · .json · in your agent: get_signal("CVE-2026-118026")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.