Description
Use-after-free in the DOM: Animation component. This vulnerability was fixed in Firefox 158 and Thunderbird 158.
Published: 2026-10-13
Score: 5.4 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Memory Corruption
Action: Patch or Upgrade
AI Analysis

Impact

A use‑after‑free flaw exists in the DOM animation component of Firefox and Thunderbird. The flaw allows the browser to read memory that has already been freed, producing memory corruption. The CVE does not provide details about specific effects on confidentiality, integrity or availability; it only identifies the animation subsystem as the affected component.

Affected Systems

All versions of Mozilla Firefox and Mozilla Thunderbird prior to version 158 are affected. The vulnerability was fixed in Firefox 158 and Thunderbird 158; no other affected versions are listed.

Risk and Exploitability

The CVSS score is 5.4, marking the flaw as medium severity. No EPSS score is available, and the vulnerability is not listed in CISA KEV. The likely attack vector is unauthenticated web content that forces the browser to process crafted animation data, which could lead to memory corruption. With no exploit probability metric and no KEV listing, uncertainty remains about how frequently this vulnerability is targeted in the wild.

Generated by OpenCVE AI on October 17, 2026 at 06:53 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade to Mozilla Firefox 158 or newer, or Mozilla Thunderbird 158 or newer, to eliminate the use‑after‑free flaw.
  • Periodically check the Mozilla security advisories page for additional patches or updates related to this issue.
  • As a temporary measure, disable DOM animations through the about:config setting ‘dom.animation.enabled’ until the patch is applied.

Generated by OpenCVE AI on October 17, 2026 at 06:53 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 13 Oct 2026 19:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 13 Oct 2026 18:30:00 +0000

Type Values Removed Values Added
Description Use-after-free in the DOM: Animation component. This vulnerability was fixed in Firefox 158. Use-after-free in the DOM: Animation component. This vulnerability was fixed in Firefox 158 and Thunderbird 158.
References

Tue, 13 Oct 2026 16:45:00 +0000

Type Values Removed Values Added
First Time appeared Mozilla
Mozilla firefox
Vendors & Products Mozilla
Mozilla firefox

Tue, 13 Oct 2026 15:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-416
Metrics cvssV3_1

{'score': 5.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N'}

Tue, 13 Oct 2026 13:00:00 +0000

Type Values Removed Values Added
Description Use-after-free in the DOM: Animation component. This vulnerability was fixed in Firefox 158.
Title Use-after-free in the DOM: Animation component
References

Subscriptions

Mozilla Firefox
cve-icon MITRE

Status: PUBLISHED

Assigner: mozilla

Published:

Updated: 2026-10-13T18:08:12.243Z

Reserved: 2026-10-13T00:29:41.019Z

Link: CVE-2026-109735

cve-icon Vulnrichment

Updated: 2026-10-13T14:13:10.744Z

cve-icon NVD

Status : Deferred

Published: 2026-10-13T13:17:24.053

Modified: 2026-10-13T19:18:37.500

Link: CVE-2026-109735

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-17T07:00:04Z

Weaknesses