Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
6.3
CVE-2026-117896: Firefox and Thunderbird can let attackers run code
CVE-2026-117896 · published 8 days ago
Summary
A memory handling bug in the web page rendering part of Firefox and Thunderbird could let a malicious website cause the program to execute unwanted code. This could lead to data theft or system takeover. Install the latest updates for Firefox, Firefox ESR, and Thunderbird as soon as possible.
What to do
- Update debian firefox-esr to version 153.6.0esr-1~deb13u1.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| – | mozilla | firefox | All versions |
| – | mozilla | thunderbird | All versions |
| Debian:12 | debian | firefox-esr | All versions |
| Debian:12 | debian | thunderbird | All versions |
| Ubuntu:18.04:LTS | canonical | mozjs52 | All versions |
| Ubuntu:18.04:LTS | canonical | mozjs38 | All versions |
| Ubuntu:20.04:LTS | canonical | mozjs68 | All versions |
| Ubuntu:22.04:LTS | canonical | mozjs102 | All versions |
| Ubuntu:22.04:LTS | canonical | mozjs78 | All versions |
| Ubuntu:22.04:LTS | canonical | mozjs91 | All versions |
| Ubuntu:22.04:LTS | canonical | thunderbird | All versions |
| Ubuntu:24.04:LTS | canonical | mozjs115 | All versions |
| Debian:13 | debian | firefox-esr |
< 153.6.0esr-1~deb13u1 Fix: upgrade to 153.6.0esr-1~deb13u1
|
Original advisory text
Use-after-free in the DOM: Core & HTML component
Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
References
- https://security-tracker.debian.org/tracker/CVE-2026-117896 Vendor Advisory
- https://www.mozilla.org/security/advisories/mfsa2026-121/
- https://ubuntu.com/security/CVE-2026-117896 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2026-117896 Third Party Advisory
- https://www.mozilla.org/en-US/security/advisories/mfsa2026-118/#CVE-2026-117896 Third Party Advisory
- https://www.mozilla.org/en-US/security/advisories/mfsa2026-120/#CVE-2026-117896 Third Party Advisory
- https://www.mozilla.org/en-US/security/advisories/mfsa2026-122/#CVE-2026-117896 Third Party Advisory
- https://bugzilla.mozilla.org/show_bug.cgi?id=2079032
- https://www.mozilla.org/security/advisories/mfsa2026-118/
- https://www.mozilla.org/security/advisories/mfsa2026-119/
- https://www.mozilla.org/security/advisories/mfsa2026-120/
- https://www.mozilla.org/security/advisories/mfsa2026-122/
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Severity
6.3
Medium
Type
CWE-416Use After Free
Timeline
Published27 Oct 2026
Updated4 Nov 2026
First seen27 Oct 2026
Sources
CVE-2026-117896 · NVD
CVE-2026-117896 · MITRE
DEBIAN-CVE-2026-117896 · OSV
UBUNTU-CVE-2026-117896 · OSV
Track software like this
Free during beta