CVE-2026-117974

Use-after-free in the XML component

8.8 HighFix available

Use-after-free in the XML component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: Required

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

0.40%Up 0.2 points since Oct 28, 2026

What each source reports

CVE List Score used 8.8

Use-after-free in the XML component

Use-after-free in the XML component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

Record: CVE-2026-117974
CVSS 3.1: 8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness: CWE-416
Updated: 2026-11-05

EUVDEUVD-2026-111005 8.8

Use-after-free in the XML component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

Record: EUVD-2026-111005
CVSS 3.1: 8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated: 2026-11-05

GitHub AdvisoriesGHSA-p299-7j52-4mr5 8.8

Use-after-free in the XML component. This vulnerability was fixed in Firefox 159, Firefox ESR 115...

Use-after-free in the XML component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, and Firefox ESR 153.6.

Record: GHSA-p299-7j52-4mr5
CVSS 3.1: 8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness: CWE-416
Updated: 2026-11-05

NVD 8.8

Use-after-free in the XML component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

Record: CVE-2026-117974
CVSS 3.1: 8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness: CWE-416
Updated: 2026-11-05

OSVDEBIAN-CVE-2026-117974 8.8

Use-after-free in the XML component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

Record: DEBIAN-CVE-2026-117974
CVSS 3.1: 8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated: 2026-11-06

OSVOESA-2026-4675 9.8

firefox security update

Mozilla Firefox is an open-source web browser, designed for standards compliance, performance and portability.

Security Fix(es):

Same-origin policy bypass in the DOM: Navigation component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117860)

Sandbox escape in the DOM: Navigation component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117861)

Privilege escalation due to incorrect boundary conditions in the Networking component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117862)

Information disclosure due to uninitialized memory in the Audio/Video component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117863)

Sandbox escape in the Form Manager component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117864)

Use-after-free in the JavaScript: GC component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117865)

Privilege escalation due to use-after-free in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117866)

Use-after-free in the Layout component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117867)

Sandbox escape in the DOM: Networking component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117868)

Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117869)

Use-after-free in the JavaScript Engine component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117870)

Invalid pointer in the Graphics component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117871)

Use-after-free in the JavaScript: Standard Library component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117872)

Incorrect boundary conditions in the Audio/Video: Playback component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117873)

Use-after-free in the Internationalization component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117874)

Use-after-free in the Layout: Scrolling and Overflow component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117875)

Use-after-free in the Layout: Text and Fonts component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117876)

Use-after-free in the Layout: Text and Fonts component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117877)

Other issue, use-after-free in the Storage: IndexedDB component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117878)

Incorrect boundary conditions in the Layout: Tables component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird…

Record: OESA-2026-4675
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-04

Show 4 moreShow less

OSVUBUNTU-CVE-2026-117974 8.8

Use-after-free in the XML component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

Record: UBUNTU-CVE-2026-117974
CVSS 3.1: 8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated: 2026-11-07

OSVopenSUSE-SU-2026:12319-1 No score

firefox-esr-153.6.0-1.1 on GA media

These are all security issues fixed in the firefox-esr-153.6.0-1.1 package on the GA media of openSUSE Tumbleweed.

Record: openSUSE-SU-2026:12319-1
Updated: 2026-11-02

OSVopenSUSE-SU-2026:12339-1 No score

MozillaThunderbird-153.6.0-1.1 on GA media

These are all security issues fixed in the MozillaThunderbird-153.6.0-1.1 package on the GA media of openSUSE Tumbleweed.

Record: openSUSE-SU-2026:12339-1
Updated: 2026-11-02

OSVSUSE-SU-2026:4928-1 No score

Security update for MozillaFirefox

This update for MozillaFirefox fixes the following issues:

Update to Firefox Extended Support Release 153.6.0 ESR (MFSA 2026-112, MFSA 2026-120, bsc#1286385):

CVE-2026-100801: Privilege escalation in the DLL Services component.
CVE-2026-113470: Cryptographic issue in the Security Block-lists, Allow-lists, and other State component (bsc#1286261).
CVE-2026-117860: Same-origin policy bypass in the DOM: Navigation component.
CVE-2026-117861: Sandbox escape in the DOM: Navigation component.
CVE-2026-117862: Privilege escalation due to incorrect boundary conditions in the Networking component.
CVE-2026-117863: Information disclosure due to uninitialized memory in the Audio/Video component.
CVE-2026-117864: Sandbox escape in the Form Manager component.
CVE-2026-117865: Use-after-free in the JavaScript: GC component.
CVE-2026-117866: Privilege escalation due to use-after-free in the Graphics: Canvas2D component.
CVE-2026-117867: Use-after-free in the Layout component.
CVE-2026-117868: Sandbox escape in the DOM: Networking component.
CVE-2026-117869: Use-after-free in the DOM: Core & HTML component.
CVE-2026-117870: Use-after-free in the JavaScript Engine component.
CVE-2026-117871: Invalid pointer in the Graphics component.
CVE-2026-117872: Use-after-free in the JavaScript: Standard Library component.
CVE-2026-117873: Incorrect boundary conditions in the Audio/Video: Playback component.
CVE-2026-117874: Use-after-free in the Internationalization component.
CVE-2026-117875: Use-after-free in the Layout: Scrolling and Overflow component.
CVE-2026-117876: Use-after-free in the Layout: Text and Fonts component.
CVE-2026-117877: Use-after-free in the Layout: Text and Fonts component.
CVE-2026-117878: Other issue, use-after-free in the Storage: IndexedDB component.
CVE-2026-117879: Incorrect boundary conditions in the Layout: Tables component.
CVE-2026-117880: Use-after-free in the XML component.
CVE-2026-117881: Use-after-free in the DOM: Core & HTML component.
CVE-2026-117882: Use-after-free in the Layout component.
CVE-2026-117883: Use-after-free in the DOM: HTML Parser component.
CVE-2026-117884: Use-after-free in the Networking component.
CVE-2026-117885: Use-after-free in the Layout: Grid component.
CVE-2026-117886: Incorrect boundary conditions in the Graphics: Text component.
CVE-2026-117887: Use-after-free in the DOM: Core & HTML component.
CVE-2026-117888: Uninitialized memory in the Graphics: Canvas2D component.
CVE-2026-117889: Incorrect boundary conditions in the JavaScript Engine component.
CVE-2026-117890: JIT miscompilation in the JavaScript Engine: JIT component.
CVE-2026-117891: Use-after-free in the JavaScript Engine: JIT component.
CVE-2026-117892: Privilege escalation due to use-after-free in the WebRTC: Networking component.
CVE-2026-117893: Incorrect boundary conditions in the Security: PSM component.
CVE-2026-117894: Incorrect boundary conditions in the WebRTC: Signaling component.
CVE-2026-117895: Use-after-free in the DOM: Core & HTML component.
CVE-2026-117896: Use-after-free in the DOM: Core & HTML component.
CVE-2026-117897: Incorrect boundary conditions in the Layout: Tables component.
CVE-2026-117898: Use-after-free in the JavaScript Engine: JIT component.
CVE-2026-117899: Use-after-free in the Networking: HTTP component.
CVE-2026-117900: Use-after-free in the DOM: Editor component.
CVE-2026-117901: Use-after-free in the DOM: Core & HTML component.
CVE-2026-117902: Use-after-free in the Layout: Text and Fonts component.
CVE-2026-117903: Use-after-free in the Audio/Video component.
CVE-2026-117904: Use-after-free in the JavaScript: GC component.
CVE-2026-117905: Use-after-free in the Audio/Video: Playback component.
CVE-2026-117906: Use-after-free in the CSS Parsing and Computation component.
CVE-2026-117907: Use-after-free in the Networking component.
CVE-2026-117908: Use-after-free in the Graphics:…

Record: SUSE-SU-2026:4928-1
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`firefox-esr` Debian:12	before 153.6.0esr-1~deb12u2, plus listed versions 102.11.0esr-1102.12.0esr-1102.12.0esr-1~deb10u1102.12.0esr-1~deb11u1102.12.0esr-1~deb12u1 Show 45 moreShow less 102.13.0esr-1102.13.0esr-1~deb10u1102.13.0esr-1~deb11u1102.13.0esr-1~deb12u1102.14.0esr-1~deb10u1102.14.0esr-1~deb11u1102.14.0esr-1~deb12u1102.15.0esr-1~deb10u1102.15.0esr-1~deb11u1102.15.0esr-1~deb12u1102.15.1esr-1~deb10u1102.15.1esr-1~deb11u1102.15.1esr-1~deb12u1115.0.2esr-1115.1.0esr-1115.10.0esr-1115.10.0esr-1~deb10u1115.10.0esr-1~deb11u1115.10.0esr-1~deb12u1115.11.0esr-1115.11.0esr-1~deb10u1115.11.0esr-1~deb11u1115.11.0esr-1~deb12u1115.12.0esr-1115.12.0esr-1~deb10u1115.12.0esr-1~deb11u1115.12.0esr-1~deb12u1115.13.0esr-1115.13.0esr-1~deb11u1115.13.0esr-1~deb12u1115.13.0esr-2115.14.0esr-1115.14.0esr-1~deb11u1115.14.0esr-1~deb12u1115.15.0esr-1115.15.0esr-1~deb11u1115.15.0esr-1~deb12u1115.2.0esr-1115.2.1esr-1115.3.0esr-1115.3.0esr-1~deb10u1115.3.0esr-1~deb11u1115.3.0esr-1~deb12u1115.3.1esr-1~deb10u1115.3.1esr-1~deb11u1	153.6.0esr-1~deb12u2
`firefox-esr` Debian:13	before 153.6.0esr-1~deb13u1, plus listed versions 128.13.0esr-1128.14.0esr-1128.14.0esr-1~deb11u1128.14.0esr-1~deb12u1128.14.0esr-1~deb13u1 Show 45 moreShow less 140.10.0esr-1140.10.0esr-1~deb11u1140.10.0esr-1~deb12u1140.10.0esr-1~deb13u1140.10.1esr-1140.10.1esr-1~deb11u1140.10.1esr-1~deb12u1140.10.1esr-1~deb13u1140.10.2esr-1140.10.2esr-1~deb11u1140.10.2esr-1~deb12u1140.10.2esr-1~deb13u1140.11.0esr-1140.11.0esr-1~deb11u1140.11.0esr-1~deb12u1140.11.0esr-1~deb13u1140.12.0esr-1140.12.0esr-1~deb11u1140.12.0esr-1~deb12u1140.12.0esr-1~deb13u1140.13.0esr-1140.13.0esr-1~deb11u1140.13.0esr-1~deb12u1140.13.0esr-1~deb13u1140.13.0esr-2140.14.0esr-1~deb11u1140.14.0esr-1~deb12u1140.14.0esr-1~deb13u1140.14.0esr-2140.15.0esr-1140.15.0esr-1~deb12u1140.15.0esr-1~deb13u1140.16.0esr-1140.16.0esr-1~deb12u1140.16.0esr-1~deb13u1140.3.0esr-1140.3.0esr-1~deb11u1140.3.0esr-1~deb11u2140.3.0esr-1~deb12u1140.3.0esr-1~deb13u1140.3.0esr-2140.3.1esr-1140.3.1esr-1~deb11u1140.3.1esr-1~deb12u1140.3.1esr-1~deb13u1	153.6.0esr-1~deb13u1
`firefox-esr` Debian:14	All versions, plus listed versions 128.13.0esr-1128.14.0esr-1128.14.0esr-1~deb11u1128.14.0esr-1~deb12u1128.14.0esr-1~deb13u1 Show 45 moreShow less 140.10.0esr-1140.10.0esr-1~deb11u1140.10.0esr-1~deb12u1140.10.0esr-1~deb13u1140.10.1esr-1140.10.1esr-1~deb11u1140.10.1esr-1~deb12u1140.10.1esr-1~deb13u1140.10.2esr-1140.10.2esr-1~deb11u1140.10.2esr-1~deb12u1140.10.2esr-1~deb13u1140.11.0esr-1140.11.0esr-1~deb11u1140.11.0esr-1~deb12u1140.11.0esr-1~deb13u1140.12.0esr-1140.12.0esr-1~deb11u1140.12.0esr-1~deb12u1140.12.0esr-1~deb13u1140.13.0esr-1140.13.0esr-1~deb11u1140.13.0esr-1~deb12u1140.13.0esr-1~deb13u1140.13.0esr-2140.14.0esr-1~deb11u1140.14.0esr-1~deb12u1140.14.0esr-1~deb13u1140.14.0esr-2140.15.0esr-1140.15.0esr-1~deb12u1140.15.0esr-1~deb13u1140.16.0esr-1140.16.0esr-1~deb12u1140.16.0esr-1~deb13u1140.3.0esr-1140.3.0esr-1~deb11u1140.3.0esr-1~deb11u2140.3.0esr-1~deb12u1140.3.0esr-1~deb13u1140.3.0esr-2140.3.1esr-1140.3.1esr-1~deb11u1140.3.1esr-1~deb12u1140.3.1esr-1~deb13u1	None known
`thunderbird` Debian:12	before 1:153.6.0esr-1~deb12u2, plus listed versions 1:102.11.0-11:102.12.0-11:102.12.0-1~deb10u11:102.12.0-1~deb11u11:102.12.0-1~deb12u1 Show 45 moreShow less 1:102.13.0-11:102.13.0-1~deb10u11:102.13.0-1~deb11u11:102.13.0-1~deb12u11:102.13.1-11:102.13.1-1~deb10u11:102.13.1-1~deb11u11:102.13.1-1~deb12u11:102.14.0-1~deb10u11:102.14.0-1~deb11u11:102.14.0-1~deb12u11:102.15.0-1~deb10u11:102.15.0-1~deb11u11:102.15.0-1~deb12u11:102.15.1-1~deb10u11:102.15.1-1~deb11u11:102.15.1-1~deb12u11:103.0~b5-11:104.0~b2-11:110.0~b4-11:112.0~b1-11:113.0~b3-11:114.0~b2-11:115.0-11:115.0.1-11:115.0.1-21:115.0~b4-11:115.0~b6-11:115.1.0-11:115.1.1-11:115.10.1-11:115.10.1-1~deb10u11:115.10.1-1~deb11u11:115.10.1-1~deb12u11:115.11.0-11:115.11.0-1~deb10u11:115.11.0-1~deb11u11:115.11.0-1~deb12u11:115.12.0-11:115.12.0-1~deb10u11:115.12.0-1~deb11u11:115.12.0-1~deb12u11:115.13.0-11:115.13.0-1~deb11u11:115.13.0-1~deb12u1	1:153.6.0esr-1~deb12u2
`thunderbird` Debian:13	before 1:153.6.0esr-1~deb13u1, plus listed versions 1:128.13.0esr-11:128.14.0esr-11:128.14.0esr-1~deb11u11:128.14.0esr-1~deb12u11:128.14.0esr-1~deb13u1 Show 45 moreShow less 1:129.0~b6-11:130.0~b3-11:132.0~b6-11:135.0-11:136.0-11:137.0-11:138.0-11:140.0.1esr-11:140.1.0esr-11:140.1.1esr-11:140.10.0esr-11:140.10.0esr-1~deb11u11:140.10.0esr-1~deb12u11:140.10.0esr-1~deb13u11:140.10.1esr-11:140.10.1esr-1~deb11u11:140.10.1esr-1~deb12u11:140.10.1esr-1~deb13u11:140.10.2esr-11:140.10.2esr-1~deb11u11:140.10.2esr-1~deb12u11:140.10.2esr-1~deb13u11:140.11.0esr-11:140.11.0esr-1~deb11u11:140.11.0esr-1~deb12u11:140.11.0esr-1~deb13u11:140.12.0esr-11:140.12.0esr-1~deb11u11:140.12.0esr-1~deb12u11:140.12.0esr-1~deb13u11:140.13.0esr-11:140.13.0esr-21:140.13.0esr-2~deb11u11:140.13.0esr-2~deb12u11:140.13.0esr-2~deb13u11:140.14.0esr-11:140.14.0esr-1~deb11u11:140.14.0esr-1~deb12u11:140.14.0esr-1~deb13u11:140.15.0esr-1~deb12u11:140.15.0esr-1~deb13u11:140.16.0esr-1~deb12u11:140.16.0esr-1~deb13u11:140.17.0esr-1~deb12u11:140.17.0esr-1~deb13u1	1:153.6.0esr-1~deb13u1
`thunderbird` Debian:14	All versions, plus listed versions 1:128.13.0esr-11:128.14.0esr-11:128.14.0esr-1~deb11u11:128.14.0esr-1~deb12u11:128.14.0esr-1~deb13u1 Show 45 moreShow less 1:129.0~b6-11:130.0~b3-11:132.0~b6-11:135.0-11:136.0-11:137.0-11:138.0-11:140.0.1esr-11:140.1.0esr-11:140.1.1esr-11:140.10.0esr-11:140.10.0esr-1~deb11u11:140.10.0esr-1~deb12u11:140.10.0esr-1~deb13u11:140.10.1esr-11:140.10.1esr-1~deb11u11:140.10.1esr-1~deb12u11:140.10.1esr-1~deb13u11:140.10.2esr-11:140.10.2esr-1~deb11u11:140.10.2esr-1~deb12u11:140.10.2esr-1~deb13u11:140.11.0esr-11:140.11.0esr-1~deb11u11:140.11.0esr-1~deb12u11:140.11.0esr-1~deb13u11:140.12.0esr-11:140.12.0esr-1~deb11u11:140.12.0esr-1~deb12u11:140.12.0esr-1~deb13u11:140.13.0esr-11:140.13.0esr-21:140.13.0esr-2~deb11u11:140.13.0esr-2~deb12u11:140.13.0esr-2~deb13u11:140.14.0esr-11:140.14.0esr-1~deb11u11:140.14.0esr-1~deb12u11:140.14.0esr-1~deb13u11:140.15.0esr-1~deb12u11:140.15.0esr-1~deb13u11:140.16.0esr-1~deb12u11:140.16.0esr-1~deb13u11:140.17.0esr-1~deb12u11:140.17.0esr-1~deb13u1	None known
`firefox` openEuler:24.03-LTS-SP3 From an advisory covering 144 CVEs	before 153.6.0-1.oe2403sp3	153.6.0-1.oe2403sp3
`MozillaFirefox` SUSE:Linux Enterprise Server 12 SP5-LTSS From an advisory covering 147 CVEs	before 153.6.0-118.19.2	153.6.0-118.19.2
`MozillaFirefox` SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5 From an advisory covering 147 CVEs	before 153.6.0-118.19.2	153.6.0-118.19.2
`mozjs52` Ubuntu:18.04:LTS	All versions, plus listed versions 52.3.1-0ubuntu352.3.1-7fakesync152.8.1-0ubuntu0.18.04.152.9.1-0ubuntu0.18.04.1	None known

Show 11 moreShow less

Affected packages
Package	Affected	Fixed
`mozjs38` Ubuntu:18.04:LTS	All versions, plus listed versions 38.8.0~repack1-0ubuntu138.8.0~repack1-0ubuntu338.8.0~repack1-0ubuntu4	None known
`mozjs68` Ubuntu:20.04:LTS	All versions, plus listed versions 68.5.0-1~fakesync68.5.0-2~fakesync68.6.0-168.6.0-1ubuntu1	None known
`mozjs52` Ubuntu:20.04:LTS	All versions, plus listed versions 52.9.1-1build152.9.1-1ubuntu3	None known
`mozjs102` Ubuntu:22.04:LTS	All versions, plus listed versions 102.11.0-0ubuntu0.22.04.1102.12.0-0ubuntu0.22.04.1102.13.0-0ubuntu0.22.04.1102.15.1-0ubuntu0.22.04.1	None known
`mozjs78` Ubuntu:22.04:LTS	All versions, plus listed versions 78.13.0-178.15.0-278.15.0-4ubuntu1	None known
`mozjs91` Ubuntu:22.04:LTS	All versions, plus listed versions 91.5.1-0ubuntu191.6.0-191.6.0-291.7.0-291.10.0-0ubuntu1	None known
`thunderbird` Ubuntu:22.04:LTS	All versions, plus listed versions 1:91.1.2+build1-0ubuntu11:91.3.0+build2-0ubuntu11:91.3.1+build1-0ubuntu11:91.3.2+build1-0ubuntu11:91.4.0+build1.1-0ubuntu1 Show 34 moreShow less 1:91.4.0+build2-0ubuntu11:91.5.0+build1-0ubuntu11:91.5.1+build1-0ubuntu11:91.6.1+build1-0ubuntu11:91.7.0+build1-0ubuntu11:91.7.0+build2-0ubuntu11:91.8.0+build2-0ubuntu11:91.9.1+build1-0ubuntu0.22.04.11:91.11.0+build2-0ubuntu0.22.04.11:102.2.2+build1-0ubuntu0.22.04.11:102.4.2+build2-0ubuntu0.22.04.11:102.7.1+build2-0ubuntu0.22.04.11:102.8.0+build2-0ubuntu0.22.04.11:102.9.0+build1-0ubuntu0.22.04.11:102.10.0+build2-0ubuntu0.22.04.11:102.11.0+build1-0ubuntu0.22.04.11:102.13.0+build1-0ubuntu0.22.04.11:102.15.0+build1-0ubuntu0.22.04.11:102.15.1+build1-0ubuntu0.22.04.11:115.3.1+build1-0ubuntu0.22.04.21:115.4.1+build1-0ubuntu0.22.04.11:115.5.0+build1-0ubuntu0.22.04.11:115.6.0+build2-0ubuntu0.22.04.11:115.8.1+build1-0ubuntu0.22.04.11:115.9.0+build1-0ubuntu0.22.04.11:115.10.1+build1-0ubuntu0.22.04.11:115.11.0+build2-0ubuntu0.22.04.11:115.12.0+build3-0ubuntu0.22.04.11:115.13.0+build5-0ubuntu0.22.04.11:115.15.0+build1-0ubuntu0.22.04.11:115.16.0+build2-0ubuntu0.22.04.11:115.18.0+build1-0ubuntu0.22.04.11:128.12.0+build1-0ubuntu0.22.04.11:140.7.1+build1-0ubuntu0.22.04.1	None known
`mozjs102` Ubuntu:24.04:LTS	All versions, plus listed versions 102.15.1-1102.15.1-3ubuntu2	None known
`mozjs115` Ubuntu:24.04:LTS	All versions, plus listed versions 115.3.0-0ubuntu1115.4.0-2115.5.0-1115.6.0-1115.7.0-4 Show 4 moreShow less 115.8.0-1115.9.0-1115.9.0-1build1115.10.0-1	None known
`firefox-esr` openSUSE:Tumbleweed From an advisory covering 144 CVEs	before 153.6.0-1.1	153.6.0-1.1
`MozillaThunderbird` openSUSE:Tumbleweed From an advisory covering 153 CVEs	before 153.6.0-1.1	153.6.0-1.1

History

History
Recorded	Changed	Sources
Nov 6, 2026	affected	EUVD, GitHub Advisories, NVD
Nov 5, 2026	cwes, severity	CVE List
Nov 4, 2026	affected, aliases, facts, references, severity	OSV
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-117974 is a high vulnerability (CVSS 8.8) in Mozilla Firefox, published October 27, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.40%, the 34th percentile. Fixed in firefox-esr 153.6.0esr-1~deb12u2.

References

Show 194 moreShow less

This page doesn't list everything

Left out here: 576 versions, 119 references and the rest of 2 source descriptions. The JSON record has them.