CVE-2026-24869

Use-after-free in the Layout: Scrolling and Overflow component

8.8 High

Use-after-free in the Layout: Scrolling and Overflow component. This vulnerability was fixed in Firefox 147.0.2.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: Required

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

0.28%Up 0.2 points since Jan 28, 2026

What each source reports

CVE List Score used 8.8

Use-after-free in the Layout: Scrolling and Overflow component

Use-after-free in the Layout: Scrolling and Overflow component. This vulnerability was fixed in Firefox 147.0.2.

Record: CVE-2026-24869
CVSS 3.1: 8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness: CWE-416
Updated: 2026-11-02

EUVDEUVD-2026-4814 8.8

Use-after-free in the Layout: Scrolling and Overflow component. This vulnerability was fixed in Firefox 147.0.2.

Record: EUVD-2026-4814
CVSS 3.1: 8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated: 2026-11-02

GitHub AdvisoriesGHSA-5hpc-pqrr-8j6m 8.1

Use-after-free in the Layout: Scrolling and Overflow component. This vulnerability affects...

Use-after-free in the Layout: Scrolling and Overflow component. This vulnerability affects Firefox < 147.0.2.

Record: GHSA-5hpc-pqrr-8j6m
CVSS 3.1: 8.1 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Weakness: CWE-416
Updated: 2026-11-02

NVD 8.8

Use-after-free in the Layout: Scrolling and Overflow component. This vulnerability was fixed in Firefox 147.0.2.

Record: CVE-2026-24869
CVSS 3.1: 8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness: CWE-416
Updated: 2026-11-02

OSVUBUNTU-CVE-2026-24869 8.1

Use-after-free in the Layout: Scrolling and Overflow component. This vulnerability affects Firefox < 147.0.2.

Record: UBUNTU-CVE-2026-24869
CVSS 3.1: 8.1 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Updated: 2026-11-02

OSVopenSUSE-SU-2026:10120-1 No score

MozillaFirefox-147.0.2-1.1 on GA media

These are all security issues fixed in the MozillaFirefox-147.0.2-1.1 package on the GA media of openSUSE Tumbleweed.

Record: openSUSE-SU-2026:10120-1
Updated: 2026-11-02

OSVopenSUSE-SU-2026:11373-1 No score

firefox-esr-153.0-1.1 on GA media

These are all security issues fixed in the firefox-esr-153.0-1.1 package on the GA media of openSUSE Tumbleweed.

Record: openSUSE-SU-2026:11373-1
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`MozillaFirefox` openSUSE:Tumbleweed From an advisory covering 2 CVEs	before 147.0.2-1.1	147.0.2-1.1
`firefox-esr` openSUSE:Tumbleweed From an advisory covering 228 CVEs	before 153.0-1.1	153.0-1.1

History

History
Recorded	Changed	Sources
Nov 6, 2026	affected, facts
Nov 3, 2026	affected
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-24869 is a high vulnerability (CVSS 8.8) in Mozilla Firefox, published January 27, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.28%, the 20th percentile. No source names a fixed version.

References

Show 194 moreShow less

This page doesn't list everything

Left out here: 38 references. The JSON record has them.