CVE-2026-117940: Use-after-free in the DOM: Core & HTML component
Published Oct 27, 2026
·Updated
Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 159 and Firefox ESR 153.6.
Affected Software
2 affected componentsFixes available
Mozilla Firefox ESR<153.6
153.6
Mozilla Firefox<159
159
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 153.6 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 159 - Upgrade
Upgrade
Firefoxto a version that resolves this vulnerability.Fixed in 159 - Upgrade
Upgrade
Firefox ESRto a version that resolves this vulnerability.Fixed in 153.6
Event History
Oct 27, 2026
CVE Published
via Mozilla·12:00 AM
Data Sourced
via Mozilla·12:00 AM
DescriptionSeverityAffected Software
CVE Published
via MITRE·02:05 PM
Data Sourced
via MITRE·02:05 PM
Description
Peer vulnerabilities
Found alongside the following vulnerabilities.
- CVE-2026-117860
- CVE-2026-117861
- CVE-2026-117862
- CVE-2026-117863
- CVE-2026-117864
- CVE-2026-117865
- CVE-2026-117866
- CVE-2026-117867
- CVE-2026-117868
- CVE-2026-117869
- CVE-2026-117870
- CVE-2026-117871
- CVE-2026-117872
- CVE-2026-117873
- CVE-2026-117874
- CVE-2026-117875
- CVE-2026-117876
- CVE-2026-117877
- CVE-2026-117878
- CVE-2026-117879
- CVE-2026-117880
- CVE-2026-117881
- CVE-2026-117882
- CVE-2026-117883
- CVE-2026-117884
- CVE-2026-117885
- CVE-2026-117886
- CVE-2026-117887
- CVE-2026-117888
- CVE-2026-117889
- CVE-2026-117890
- CVE-2026-117891
- CVE-2026-117892
- CVE-2026-117893
- CVE-2026-117894
- CVE-2026-117895
- CVE-2026-117896
- CVE-2026-117897
- CVE-2026-117898
- CVE-2026-117899
- CVE-2026-117900
- CVE-2026-117901
- CVE-2026-117902
- CVE-2026-117903
- CVE-2026-117904
- CVE-2026-117905
- CVE-2026-117906
- CVE-2026-117907
- CVE-2026-117908
- CVE-2026-117909
- CVE-2026-117910
- CVE-2026-117911
- CVE-2026-117912
- CVE-2026-117913
- CVE-2026-117914
- CVE-2026-117915
- CVE-2026-117916
- CVE-2026-117917
- CVE-2026-117918
- CVE-2026-117919
- CVE-2026-117920
- CVE-2026-117921
- CVE-2026-117922
- CVE-2026-117923
- CVE-2026-117924
- CVE-2026-117925
- CVE-2026-117926
- CVE-2026-117927
- CVE-2026-117928
- CVE-2026-117929
- CVE-2026-117930
- CVE-2026-117931
- CVE-2026-117932
- CVE-2026-117933
- CVE-2026-117934
- CVE-2026-117935
- CVE-2026-117936
- CVE-2026-117937
- CVE-2026-117938
- CVE-2026-117939
- CVE-2026-117940
- CVE-2026-117941
- CVE-2026-117942
- CVE-2026-117943
- CVE-2026-117944
- CVE-2026-117945
- CVE-2026-117946
- CVE-2026-117947
- CVE-2026-117948
- CVE-2026-117949
- CVE-2026-117950
- CVE-2026-117951
- CVE-2026-117952
- CVE-2026-117953
- CVE-2026-117954
- CVE-2026-117955
- CVE-2026-100801
- CVE-2026-117956
- CVE-2026-117957
- CVE-2026-117958
- CVE-2026-117959
- CVE-2026-117960
- CVE-2026-117961
- CVE-2026-117962
- CVE-2026-117963
- CVE-2026-117964
- CVE-2026-117965
- CVE-2026-117966
- CVE-2026-117967
- CVE-2026-117968
- CVE-2026-117969
- CVE-2026-117970
- CVE-2026-117971
- CVE-2026-117972
- CVE-2026-117973
- CVE-2026-117974
- CVE-2026-117975
- CVE-2026-117976
- CVE-2026-117977
- CVE-2026-117978
- CVE-2026-117979
- CVE-2026-117980
- CVE-2026-117981
- CVE-2026-117982
- CVE-2026-117983
- CVE-2026-117984
- CVE-2026-117985
- CVE-2026-117986
- CVE-2026-117987
- CVE-2026-117988
- CVE-2026-117989
- CVE-2026-117990
- CVE-2026-117991
- CVE-2026-117992
- CVE-2026-117993
- CVE-2026-117994
- CVE-2026-117995
- CVE-2026-117996
- CVE-2026-117997
- CVE-2026-117998
- CVE-2026-117999
- CVE-2026-118000
- CVE-2026-118002
- CVE-2026-118003
- CVE-2026-118004
- CVE-2026-118005
- CVE-2026-118006
- CVE-2026-118007
- CVE-2026-118008
- CVE-2026-118009
- CVE-2026-118010
- CVE-2026-118011
- CVE-2026-118012
- CVE-2026-118013
- CVE-2026-118014
- CVE-2026-118015
- CVE-2026-118016
- CVE-2026-118017
- CVE-2026-118018
- CVE-2026-118019
- CVE-2026-118020
- CVE-2026-118021
- CVE-2026-118022
- CVE-2026-118023
- CVE-2026-118024
- CVE-2026-118025
- CVE-2026-118026
Frequently Asked Questions
1
Which Firefox releases contain the fix?
The vulnerability was fixed in Firefox 159 and Firefox ESR 153.6.
2
Which products should be reviewed for exposure?
Review deployments of Mozilla Firefox and Mozilla Firefox ESR, particularly any installations that have not been updated to Firefox 159 or Firefox ESR 153.6.