Description
Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.
Published: 2026-10-13
Score: 5.4 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Memory Corruption
Action: Apply Patch
AI Analysis

Impact

The vulnerability is a use‑after‑free bug in the DOM core and HTML component. It was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.

Affected Systems

All releases of Mozilla Firefox (both standard and ESR) before version 158 and the ESR 153.5 release, as well as all releases of Mozilla Thunderbird before version 158 and the Thunderbird ESR 153.5 release, are vulnerable. Users of older standard releases or earlier ESR versions are at risk until they install the patch contained in the respective 158 or 153.5 updates.

Risk and Exploitability

The CVSS score of 5.4 indicates moderate severity. No EPSS score is available and the vulnerability is not listed in the CISA KEV catalog, indicating limited public exploitation evidence. The description does not provide details about how an attacker could trigger the flaw or the potential impact, so the risk remains assessed as low to moderate based on the technical nature of a use‑after‑free bug and default assumptions about exploitability. The vulnerability is not known to be actively used in the wild.

Generated by OpenCVE AI on October 13, 2026 at 21:01 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade Mozilla Firefox to version 158 or later, or to Firefox ESR 153.5 or later, where the use‑after‑free flaw is fixed.
  • If a newer standard release cannot be installed immediately, switch to the latest ESR release to obtain the hotfix.
  • Enable automatic browser updates so that future patches are applied automatically.

Generated by OpenCVE AI on October 13, 2026 at 21:01 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DLA Debian DLA DLA-4836-1 firefox-esr security update
Debian DLA Debian DLA DLA-4863-1 thunderbird security update
Debian DSA Debian DSA DSA-6560-1 firefox-esr security update
History

Tue, 13 Oct 2026 18:30:00 +0000

Type Values Removed Values Added
Description Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 158 and Firefox ESR 153.5. Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.
References

Tue, 13 Oct 2026 16:45:00 +0000

Type Values Removed Values Added
First Time appeared Mozilla
Mozilla firefox
Vendors & Products Mozilla
Mozilla firefox

Tue, 13 Oct 2026 15:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-416
Metrics cvssV3_1

{'score': 5.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N'}

Tue, 13 Oct 2026 13:00:00 +0000

Type Values Removed Values Added
Description Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 158 and Firefox ESR 153.5.
Title Use-after-free in the DOM: Core & HTML component
References

Subscriptions

Mozilla Firefox
cve-icon MITRE

Status: PUBLISHED

Assigner: mozilla

Published:

Updated: 2026-10-13T18:16:57.204Z

Reserved: 2026-10-13T00:29:31.304Z

Link: CVE-2026-109724

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Deferred

Published: 2026-10-13T13:17:22.907

Modified: 2026-10-13T19:18:36.123

Link: CVE-2026-109724

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-13T21:15:16Z

Weaknesses