CVE-2026-117997

Sandbox escape due to use-after-free in the Widget component

Sandbox escape due to use-after-free in the Widget component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

CVSS 3.1 · 9.6 Critical EPSS < 1% KEV · Not listed

Vendors

Mozilla

Products

Firefox

CVE-2026-118014

Use-after-free in the JavaScript Engine: JIT component

Use-after-free in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 159 and Thunderbird 159.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Mozilla

Products

Firefox

CVE-2026-121953

FreeRDP before 3.32.2 Use-After-Free via rdpgfx Dynamic Virtual Channel Close

FreeRDP before 3.32.2 has a use-after-free in the client's rdpgfx dynamic virtual channel: a duplicate-name channel with a new ChannelId overwrites the listener's single callback slot, which rdpgfx_on_close frees without clearing. A malicious RDP server can open and close such a channel, then send a PDU on the original channel to crash the client or potentially execute code.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Freerdp

Products

Freerdp

CVE-2026-121955

FreeRDP before 3.32.2 Use-After-Free in Smartcard Emulation ReleaseContext

FreeRDP before 3.32.2 contains a use-after-free vulnerability in Emulate_SCardReleaseContext that frees the emulated SCardContext before its worker thread is cancelled and joined. A malicious server can send ESTABLISHCONTEXT, a long-timeout GETSTATUSCHANGE, then RELEASECONTEXT smartcard IRPs to corrupt heap memory or crash clients using smartcard emulation.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Freerdp

Products

Freerdp

CVE-2026-121956

FreeRDP before 3.32.2 Double Free in WinPR Kerberos retrieveSomeTgt

FreeRDP before 3.32.2 contains a double free in the WinPR Kerberos SSPI retrieveSomeTgt function, which installs the krb5 default realm into a target principal that has an empty realm without taking ownership of it. Unauthenticated remote clients can send a crafted NLA/CredSSP u2u TGT request whose server-name component contains '@' to corrupt the heap and crash the server process.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Freerdp

Products

Freerdp

CVE-2026-117975

Sandbox escape due to invalid pointer in the Graphics: WebRender component

Sandbox escape due to invalid pointer in the Graphics: WebRender component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Mozilla

Products

Firefox

CVE-2026-18663

389-ds-base: 389-ds-base: pre-authentication double-free in get_ldapmessage_controls_ext() via critical session tracking control

A flaw was found in 389-ds-base. The get_ldapmessage_controls_ext() function frees the parsed controls array on the Session Tracking critical-control rejection path without clearing the SLAPI_REQCONTROLS pblock slot. Operation teardown then frees the same pointer again, causing a double-free. An unauthenticated remote attacker can trigger this with a single BIND request carrying a critical Session Tracking control, resulting in heap corruption and potential denial of service.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Directory Server Enterprise Linux Rhel Els

CVE-2026-117982

Invalid pointer in the JavaScript Engine: JIT component

Invalid pointer in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Mozilla

Products

Firefox

CVE-2026-121077

chromium-browser: Use after free in Mobile

Use after free in Mobile in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

CVSS 3.1 · 9.6 Critical EPSS < 1% KEV · Not listed

Vendors

Google

Products

Chrome

CVE-2026-121201

chromium-browser: Use after free in Animation

Use after free in Animation in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Google

Products

Chrome

CVE-2026-121128

chromium-browser: Use after free in Scheduling

Use after free in Scheduling in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Google

Products

Chrome

CVE-2026-121117

chromium-browser: Use after free in Paint

Use after free in Paint in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Google

Products

Chrome

CVE-2026-121217

chromium-browser: Use after free in Streaming

Use after free in Streaming in Google Chrome prior to 157.0.8103.38 allowed an adjacent attacker to execute arbitrary code inside the sandbox via crafted network traffic. (Chromium security severity: Low)

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Google

Products

Chrome

CVE-2026-121211

chromium-browser: Use after free in PowerBookmarks

Use after free in PowerBookmarks in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to execute arbitrary code outside the sandbox via a crafted Chrome extension. (Chromium security severity: High)

CVSS 3.1 · 8.3 High EPSS < 1% KEV · Not listed

Vendors

Google

Products

Chrome

CVE-2026-118026

Invalid pointer in the JavaScript: GC component

Invalid pointer in the JavaScript: GC component. This vulnerability was fixed in Firefox 159 and Thunderbird 159.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Mozilla

Products

Firefox

CVE-2026-118023

Sandbox escape due to use-after-free in the Graphics: WebRender component

Sandbox escape due to use-after-free in the Graphics: WebRender component. This vulnerability was fixed in Firefox 159 and Thunderbird 159.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Mozilla

Products

Firefox

CVE-2026-118022

Sandbox escape due to use-after-free in the Disability Access APIs component

Sandbox escape due to use-after-free in the Disability Access APIs component. This vulnerability was fixed in Firefox 159 and Thunderbird 159.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Mozilla

Products

Firefox

CVE-2026-118020

Use-after-free in the Layout component

Use-after-free in the Layout component. This vulnerability was fixed in Firefox 159 and Thunderbird 159.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Mozilla

Products

Firefox

CVE-2026-118017

Use-after-free in the SVG component

Use-after-free in the SVG component. This vulnerability was fixed in Firefox 159 and Thunderbird 159.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Mozilla

Products

Firefox

CVE-2026-118016

Use-after-free in the DOM: Core & HTML component

Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 159 and Thunderbird 159.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Mozilla

Products

Firefox