CVE-2026-117xxx records

Browse official CVE Program records with vulnerability descriptions, affected products, CVSS scores and source references. Browse by the year and numeric range in each CVE ID; publication and update dates appear on each record.

407 records · Page 1 of 5

• CVE-2026-117999: Race condition in the IPC component Unscored

  Race condition in the IPC component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

  Updated 2026-10-27
• CVE-2026-117998: Mitigation bypass in the DOM: Push Subscriptions component Unscored

  Mitigation bypass in the DOM: Push Subscriptions component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

  Updated 2026-10-27
• CVE-2026-117997: Sandbox escape due to use-after-free in the Widget component Unscored

  Sandbox escape due to use-after-free in the Widget component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

  Updated 2026-10-27
• CVE-2026-117996: Incorrect boundary conditions in the WebRTC component Unscored

  Incorrect boundary conditions in the WebRTC component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

  Updated 2026-10-27
• CVE-2026-117995: Privilege escalation in the DOM: UI Events & Focus Handling component Unscored

  Privilege escalation in the DOM: UI Events & Focus Handling component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

  Updated 2026-10-27
• CVE-2026-117994: Use-after-free in the JavaScript: GC component Unscored

  Use-after-free in the JavaScript: GC component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

  Updated 2026-10-27
• CVE-2026-117993: Integer overflow in the Graphics: Text component Unscored

  Integer overflow in the Graphics: Text component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

  Updated 2026-10-27
• CVE-2026-117992: Information disclosure in the CSS Parsing and Computation component Unscored

  Information disclosure in the CSS Parsing and Computation component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

  Updated 2026-10-27
• CVE-2026-117991: Incorrect boundary conditions in the Layout: Text and Fonts component Unscored

  Incorrect boundary conditions in the Layout: Text and Fonts component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

  Updated 2026-10-27
• CVE-2026-117990: Sandbox escape due to incorrect boundary conditions in the Graphics: WebRender component Unscored

  Sandbox escape due to incorrect boundary conditions in the Graphics: WebRender component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

  Updated 2026-10-27
• CVE-2026-117989: Use-after-free in the Graphics component Unscored

  Use-after-free in the Graphics component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

  Updated 2026-10-27
• CVE-2026-117988: Sandbox escape due to incorrect boundary conditions in the Graphics: CanvasWebGL component Unscored

  Sandbox escape due to incorrect boundary conditions in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

  Updated 2026-10-27
• CVE-2026-117987: Use-after-free in the Graphics component Unscored

  Use-after-free in the Graphics component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

  Updated 2026-10-27
• CVE-2026-117986: Use-after-free in the Graphics component Unscored

  Use-after-free in the Graphics component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

  Updated 2026-10-27
• CVE-2026-117985: Sandbox escape due to use-after-free in the Graphics component Unscored

  Sandbox escape due to use-after-free in the Graphics component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

  Updated 2026-10-27
• CVE-2026-117984: Incorrect boundary conditions in the Layout: Scrolling and Overflow component Unscored

  Incorrect boundary conditions in the Layout: Scrolling and Overflow component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

  Updated 2026-10-27
• CVE-2026-117983: Use-after-free in the Graphics component Unscored

  Use-after-free in the Graphics component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

  Updated 2026-10-27
• CVE-2026-117982: Invalid pointer in the JavaScript Engine: JIT component Unscored

  Invalid pointer in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

  Updated 2026-10-27
• CVE-2026-117981: Privilege escalation in the Toolkit component Unscored

  Privilege escalation in the Toolkit component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

  Updated 2026-10-27
• CVE-2026-117980: Use-after-free in the Graphics component Unscored

  Use-after-free in the Graphics component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

  Updated 2026-10-27
• CVE-2026-117979: Incorrect boundary conditions in the Graphics: WebRender component Unscored

  Incorrect boundary conditions in the Graphics: WebRender component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

  Updated 2026-10-27
• CVE-2026-117978: Incorrect boundary conditions in the Graphics component Unscored

  Incorrect boundary conditions in the Graphics component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

  Updated 2026-10-27
• CVE-2026-117977: Other issue in the Console component Unscored

  Other issue in the Console component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

  Updated 2026-10-27
• CVE-2026-117976: Site isolation issue in the DOM: Navigation component Unscored

  Site isolation issue in the DOM: Navigation component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

  Updated 2026-10-27
• CVE-2026-117975: Sandbox escape due to invalid pointer in the Graphics: WebRender component Unscored

  Sandbox escape due to invalid pointer in the Graphics: WebRender component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

  Updated 2026-10-27
• CVE-2026-117974: Use-after-free in the XML component Unscored

  Use-after-free in the XML component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

  Updated 2026-10-27
• CVE-2026-117973: Use-after-free in the Networking: DNS component Unscored

  Use-after-free in the Networking: DNS component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

  Updated 2026-10-27
• CVE-2026-117972: Use-after-free in the Graphics component Unscored

  Use-after-free in the Graphics component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

  Updated 2026-10-27
• CVE-2026-117971: Sandbox escape due to use-after-free in the Print Preview component Unscored

  Sandbox escape due to use-after-free in the Print Preview component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

  Updated 2026-10-27
• CVE-2026-117970: Race condition in the Disability Access APIs component Unscored

  Race condition in the Disability Access APIs component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

  Updated 2026-10-27
• CVE-2026-117969: Invalid pointer in the JavaScript Engine: JIT component Unscored

  Invalid pointer in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

  Updated 2026-10-27
• CVE-2026-117968: Use-after-free in the DOM: Core & HTML component Unscored

  Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

  Updated 2026-10-27
• CVE-2026-117967: Mitigation bypass in the DOM: Security component Unscored

  Mitigation bypass in the DOM: Security component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

  Updated 2026-10-27
• CVE-2026-117966: Site isolation issue in the Networking: HTTP component Unscored

  Site isolation issue in the Networking: HTTP component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

  Updated 2026-10-27
• CVE-2026-117965: Same-origin policy bypass in the Address Bar component Unscored

  Same-origin policy bypass in the Address Bar component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

  Updated 2026-10-27
• CVE-2026-117964: Use-after-free in the Panning and Zooming component Unscored

  Use-after-free in the Panning and Zooming component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

  Updated 2026-10-27
• CVE-2026-117963: Incorrect boundary conditions in the DOM: Service Workers component Unscored

  Incorrect boundary conditions in the DOM: Service Workers component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

  Updated 2026-10-27
• CVE-2026-117962: Sandbox escape due to incorrect boundary conditions in the Storage: Quota Manager component Unscored

  Sandbox escape due to incorrect boundary conditions in the Storage: Quota Manager component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

  Updated 2026-10-27
• CVE-2026-117961: Incorrect boundary conditions in the Layout: Text and Fonts component Unscored

  Incorrect boundary conditions in the Layout: Text and Fonts component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

  Updated 2026-10-27
• CVE-2026-117960: Spoofing issue in the DOM: Core & HTML component Unscored

  Spoofing issue in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

  Updated 2026-10-27
• CVE-2026-117959: Site isolation issue in the DOM: Service Workers component Unscored

  Site isolation issue in the DOM: Service Workers component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

  Updated 2026-10-27
• CVE-2026-117958: Site isolation issue in the Networking: HTTP component Unscored

  Site isolation issue in the Networking: HTTP component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

  Updated 2026-10-27
• CVE-2026-117957: Cryptographic issue in the WebRTC: Networking component Unscored

  Cryptographic issue in the WebRTC: Networking component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

  Updated 2026-10-27
• CVE-2026-117956: Invalid pointer in the Nimbus Desktop Client component Unscored

  Invalid pointer in the Nimbus Desktop Client component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

  Updated 2026-10-27
• CVE-2026-117955: JIT miscompilation in the JavaScript: WebAssembly component Unscored

  JIT miscompilation in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

  Updated 2026-10-27
• CVE-2026-117954: Use-after-free in the Layout: Positioned component Unscored

  Use-after-free in the Layout: Positioned component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

  Updated 2026-10-27
• CVE-2026-117953: Use-after-free in the DOM: Core & HTML component Unscored

  Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

  Updated 2026-10-27
• CVE-2026-117952: Uninitialized memory in the Networking component Unscored

  Uninitialized memory in the Networking component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

  Updated 2026-10-27
• CVE-2026-117951: Use-after-free in the DOM: Core & HTML component Unscored

  Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

  Updated 2026-10-27
• CVE-2026-117950: Incorrect boundary conditions in the DOM: Core & HTML component Unscored

  Incorrect boundary conditions in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

  Updated 2026-10-27
• CVE-2026-117949: Use-after-free in the DOM: Core & HTML component Unscored

  Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

  Updated 2026-10-27
• CVE-2026-117948: Use-after-free in the SVG component Unscored

  Use-after-free in the SVG component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

  Updated 2026-10-27
• CVE-2026-117947: Use-after-free in the XML component Unscored

  Use-after-free in the XML component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

  Updated 2026-10-27
• CVE-2026-117946: Incorrect boundary conditions in the JavaScript Engine component Unscored

  Incorrect boundary conditions in the JavaScript Engine component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

  Updated 2026-10-27
• CVE-2026-117945: Incorrect boundary conditions in the XML component Unscored

  Incorrect boundary conditions in the XML component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

  Updated 2026-10-27
• CVE-2026-117944: Use-after-free in the Layout component Unscored

  Use-after-free in the Layout component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

  Updated 2026-10-27
• CVE-2026-117943: Use-after-free in the DOM: Core & HTML component Unscored

  Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

  Updated 2026-10-27
• CVE-2026-117942: Incorrect boundary conditions in the JavaScript Engine: JIT component Unscored

  Incorrect boundary conditions in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

  Updated 2026-10-27
• CVE-2026-117941: Use-after-free in the DOM: CSS Object Model component Unscored

  Use-after-free in the DOM: CSS Object Model component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

  Updated 2026-10-27
• CVE-2026-117940: Use-after-free in the DOM: Core & HTML component Unscored

  Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

  Updated 2026-10-27
• CVE-2026-117939: Use-after-free in the XML component Unscored

  Use-after-free in the XML component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

  Updated 2026-10-27
• CVE-2026-117938: Use-after-free in the Layout component Unscored

  Use-after-free in the Layout component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

  Updated 2026-10-27
• CVE-2026-117937: Invalid pointer in the JavaScript Engine component Unscored

  Invalid pointer in the JavaScript Engine component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

  Updated 2026-10-27
• CVE-2026-117936: Use-after-free in the DOM: Core & HTML component Unscored

  Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

  Updated 2026-10-27
• CVE-2026-117935: Use-after-free in the DOM: Bindings (WebIDL) component Unscored

  Use-after-free in the DOM: Bindings (WebIDL) component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

  Updated 2026-10-27
• CVE-2026-117934: Use-after-free in the Layout component Unscored

  Use-after-free in the Layout component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

  Updated 2026-10-27
• CVE-2026-117933: Frame poisoning in the CSS Parsing and Computation component Unscored

  Frame poisoning in the CSS Parsing and Computation component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

  Updated 2026-10-27
• CVE-2026-117932: Use-after-free in the DOM: Core & HTML component Unscored

  Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

  Updated 2026-10-27
• CVE-2026-117931: Use-after-free in the DOM: Events component Unscored

  Use-after-free in the DOM: Events component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

  Updated 2026-10-27
• CVE-2026-117930: Use-after-free in the DOM: Bindings (WebIDL) component Unscored

  Use-after-free in the DOM: Bindings (WebIDL) component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

  Updated 2026-10-27
• CVE-2026-117929: Use-after-free in the DOM: Core & HTML component Unscored

  Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

  Updated 2026-10-27
• CVE-2026-117928: Same-origin policy bypass in the CSS Parsing and Computation component Unscored

  Same-origin policy bypass in the CSS Parsing and Computation component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

  Updated 2026-10-27
• CVE-2026-117927: Use-after-free in the SVG component Unscored

  Use-after-free in the SVG component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

  Updated 2026-10-27
• CVE-2026-117926: Incorrect boundary conditions in the SVG component Unscored

  Incorrect boundary conditions in the SVG component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

  Updated 2026-10-27
• CVE-2026-117925: Use-after-free in the DOM: Core & HTML component Unscored

  Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

  Updated 2026-10-27
• CVE-2026-117924: Use-after-free in the XSLT component Unscored

  Use-after-free in the XSLT component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

  Updated 2026-10-27
• CVE-2026-117923: Use-after-free in the Audio/Video component Unscored

  Use-after-free in the Audio/Video component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

  Updated 2026-10-27
• CVE-2026-117922: Use-after-free in the Networking: WebSockets component Unscored

  Use-after-free in the Networking: WebSockets component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

  Updated 2026-10-27
• CVE-2026-117921: Use-after-free in the CSS Parsing and Computation component Unscored

  Use-after-free in the CSS Parsing and Computation component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

  Updated 2026-10-27
• CVE-2026-117920: Use-after-free in the DOM: HTML Parser component Unscored

  Use-after-free in the DOM: HTML Parser component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

  Updated 2026-10-27
• CVE-2026-117919: Use-after-free in the DOM: Core & HTML component Unscored

  Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

  Updated 2026-10-27
• CVE-2026-117918: Use-after-free in the Graphics: Canvas2D component Unscored

  Use-after-free in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

  Updated 2026-10-27
• CVE-2026-117917: Invalid pointer in the Graphics: WebRender component Unscored

  Invalid pointer in the Graphics: WebRender component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

  Updated 2026-10-27
• CVE-2026-117916: Use-after-free in the XSLT component Unscored

  Use-after-free in the XSLT component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

  Updated 2026-10-27
• CVE-2026-117915: Incorrect boundary conditions in the Layout: Block and Inline component Unscored

  Incorrect boundary conditions in the Layout: Block and Inline component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

  Updated 2026-10-27
• CVE-2026-117914: Use-after-free in the SVG component Unscored

  Use-after-free in the SVG component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

  Updated 2026-10-27
• CVE-2026-117913: Use-after-free in the SVG component Unscored

  Use-after-free in the SVG component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

  Updated 2026-10-27
• CVE-2026-117912: Same-origin policy bypass in the CSS Parsing and Computation component Unscored

  Same-origin policy bypass in the CSS Parsing and Computation component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

  Updated 2026-10-27
• CVE-2026-117911: Use-after-free in the Audio/Video: Playback component Unscored

  Use-after-free in the Audio/Video: Playback component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

  Updated 2026-10-27
• CVE-2026-117910: Invalid pointer in the JavaScript Engine component Unscored

  Invalid pointer in the JavaScript Engine component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

  Updated 2026-10-27
• CVE-2026-117909: Use-after-free in the JavaScript: GC component Unscored

  Use-after-free in the JavaScript: GC component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

  Updated 2026-10-27
• CVE-2026-117908: Use-after-free in the Graphics: ImageLib component Unscored

  Use-after-free in the Graphics: ImageLib component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

  Updated 2026-10-27
• CVE-2026-117907: Use-after-free in the Networking component Unscored

  Use-after-free in the Networking component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

  Updated 2026-10-27
• CVE-2026-117906: Use-after-free in the CSS Parsing and Computation component Unscored

  Use-after-free in the CSS Parsing and Computation component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

  Updated 2026-10-27
• CVE-2026-117905: Use-after-free in the Audio/Video: Playback component Unscored

  Use-after-free in the Audio/Video: Playback component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

  Updated 2026-10-27
• CVE-2026-117904: Use-after-free in the JavaScript: GC component Unscored

  Use-after-free in the JavaScript: GC component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

  Updated 2026-10-27
• CVE-2026-117903: Use-after-free in the Audio/Video component Unscored

  Use-after-free in the Audio/Video component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

  Updated 2026-10-27
• CVE-2026-117902: Use-after-free in the Layout: Text and Fonts component Unscored

  Use-after-free in the Layout: Text and Fonts component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

  Updated 2026-10-27
• CVE-2026-117901: Use-after-free in the DOM: Core & HTML component Unscored

  Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

  Updated 2026-10-27
• CVE-2026-117900: Use-after-free in the DOM: Editor component Unscored

  Use-after-free in the DOM: Editor component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

  Updated 2026-10-27

Search a CVE ID or check dependency files →