Description
Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
Published: 2026-10-27
Score: n/a
EPSS: n/a
KEV: No
Impact: Remote code execution
Action: Immediate Patch
AI Analysis

Impact

The vulnerability is a use‑after‑free in the DOM core and HTML component of Mozilla Firefox and Thunderbird. The flaw could corrupt memory and, if exploited, allows an attacker to execute arbitrary code or crash the browser. It poses a high‑severity risk.

Affected Systems

Mozilla Firefox and Thunderbird are affected. Versions older than Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, or Thunderbird 153.6 are vulnerable. Users running any legacy release face the use‑after‑free flaw until they upgrade.

Risk and Exploitability

Because the flaw resides in the browser’s rendering engine, it can be triggered by a malicious web page or script, making remote exploitation feasible from a network context. No EPSS data is available and the issue is not listed in the CISA KEV catalog, yet the absence of a patch in legacy versions leaves a high impact window. The lack of mitigation beyond updating the product heightens the threat.

Generated by OpenCVE AI on October 27, 2026 at 22:42 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade Firefox to version 159 or later, or to the latest ESR release that includes the 115.44/153.6 fixes.
  • Apply all other available Mozilla security updates concurrently to ensure related components are patched.
  • If an upgrade is not immediately feasible, restrict the use of the affected browser by disabling it in group policy or uninstalling legacy versions to prevent potential exploitation.

Generated by OpenCVE AI on October 27, 2026 at 22:42 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 27 Oct 2026 23:00:00 +0000

Type Values Removed Values Added
Weaknesses CWE-416

Tue, 27 Oct 2026 20:45:00 +0000

Type Values Removed Values Added
Weaknesses CWE-416

Tue, 27 Oct 2026 18:45:00 +0000

Type Values Removed Values Added
Description Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, and Thunderbird 159. Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
References

Tue, 27 Oct 2026 18:30:00 +0000

Type Values Removed Values Added
Description Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, and Firefox ESR 153.6. Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, and Thunderbird 159.
References

Tue, 27 Oct 2026 16:00:00 +0000

Type Values Removed Values Added
First Time appeared Mozilla
Mozilla firefox
Weaknesses CWE-416
Vendors & Products Mozilla
Mozilla firefox

Tue, 27 Oct 2026 14:15:00 +0000

Type Values Removed Values Added
Description Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, and Firefox ESR 153.6.
Title Use-after-free in the DOM: Core & HTML component
References

Subscriptions

Mozilla Firefox
cve-icon MITRE

Status: PUBLISHED

Assigner: mozilla

Published:

Updated: 2026-10-27T18:28:32.748Z

Reserved: 2026-10-27T14:05:15.154Z

Link: CVE-2026-117895

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Deferred

Published: 2026-10-27T14:16:44.930

Modified: 2026-10-27T19:17:14.767

Link: CVE-2026-117895

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-27T22:45:09Z

Weaknesses