BugRater
Early access. The directory is still filling out, and every rating here comes from a researcher's reported experience.

Security releases

Mozilla

Security Vulnerabilities fixed in Firefox 159

MFSA2026-118 Oct 27, 2026 Source: Vendor

Imported from Mozilla security advisory MFSA2026-118. Draft.

Source of record The credited names below are quoted verbatim from the vendor's own advisory: https://www.mozilla.org/en-US/security/advisories/mfsa2026-118/
Are you credited here? Sign in to claim your line. It is yours immediately, with no review queue. The name the vendor printed stays next to your handle for anyone to check against the advisory above, and any member who thinks a claim is wrong can refute it.

Credited

167 lines
All 167 CVEs 167 Additional recognition 0 Unclaimed only
Showing 1–50 of 167 , page 1 of 4
CVE-2026-117860 BR2026-0000-037625 unclaimed
High: Same-origin policy bypass in the DOM: Navigation component
Credited as satyamasd
CVE-2026-117861 BR2026-0000-037626 unclaimed
High: Sandbox escape in the DOM: Navigation component
Credited as Mozilla
CVE-2026-117862 BR2026-0000-037627 unclaimed
High: Privilege escalation due to incorrect boundary conditions in the Networking component
Credited as Mozilla
CVE-2026-117863 BR2026-0000-037628 unclaimed
High: Information disclosure due to uninitialized memory in the Audio/Video component
Credited as Mozilla
CVE-2026-117864 BR2026-0000-037629 unclaimed
High: Sandbox escape in the Form Manager component
Credited as Mozilla
CVE-2026-117865 BR2026-0000-037630 unclaimed
High: Use-after-free in the JavaScript: GC component
Credited as Mozilla
CVE-2026-117866 BR2026-0000-037631 unclaimed
High: Privilege escalation due to use-after-free in the Graphics: Canvas2D component
Credited as Mozilla
CVE-2026-117867 BR2026-0000-037632 unclaimed
High: Use-after-free in the Layout component
Credited as Mozilla
CVE-2026-117868 BR2026-0000-037633 unclaimed
High: Sandbox escape in the DOM: Networking component
Credited as Yaqoub Aldurayhim
CVE-2026-117869 BR2026-0000-037634 unclaimed
High: Use-after-free in the DOM: Core & HTML component
Credited as Mozilla
CVE-2026-117870 BR2026-0000-037635 unclaimed
High: Use-after-free in the JavaScript Engine component
Credited as Mozilla
CVE-2026-117871 BR2026-0000-037636 unclaimed
High: Invalid pointer in the Graphics component
Credited as Mozilla
CVE-2026-117872 BR2026-0000-037637 unclaimed
High: Use-after-free in the JavaScript: Standard Library component
Credited as Mozilla
CVE-2026-117873 BR2026-0000-037638 unclaimed
High: Incorrect boundary conditions in the Audio/Video: Playback component
Credited as Mozilla
CVE-2026-118005 BR2026-0000-037639 unclaimed
High: Use-after-free in the WebRTC: Signaling component
Credited as Mozilla
CVE-2026-117874 BR2026-0000-037640 unclaimed
High: Use-after-free in the Internationalization component
Credited as Mozilla
CVE-2026-117875 BR2026-0000-037641 unclaimed
High: Use-after-free in the Layout: Scrolling and Overflow component
Credited as Mozilla
CVE-2026-117876 BR2026-0000-037642 unclaimed
High: Use-after-free in the Layout: Text and Fonts component
Credited as Amy Burnett of OpenAI
CVE-2026-118006 BR2026-0000-037643 unclaimed
High: Privilege escalation due to use-after-free in the WebRTC: Signaling component
Credited as Mozilla
CVE-2026-117877 BR2026-0000-037644 unclaimed
High: Use-after-free in the Layout: Text and Fonts component
Credited as Mozilla
CVE-2026-118007 BR2026-0000-037645 unclaimed
High: Use-after-free in the JavaScript: GC component
Credited as Mozilla
CVE-2026-117878 BR2026-0000-037646 unclaimed
High: Other issue, use-after-free in the Storage: IndexedDB component
Credited as Amy Burnett of OpenAI
CVE-2026-117879 BR2026-0000-037647 unclaimed
High: Incorrect boundary conditions in the Layout: Tables component
Credited as Amy Burnett of OpenAI
CVE-2026-118008 BR2026-0000-037648 unclaimed
High: Privilege escalation in the DOM: Navigation component
Credited as Amy Burnett of OpenAI
CVE-2026-117880 BR2026-0000-037649 unclaimed
High: Use-after-free in the XML component
Credited as Mozilla
CVE-2026-118009 BR2026-0000-037650 unclaimed
High: Integer overflow, use-after-free in the Graphics: Text component
Credited as Nguyen Thanh Nguyen
CVE-2026-117881 BR2026-0000-037651 unclaimed
High: Use-after-free in the DOM: Core & HTML component
Credited as Amy Burnett of OpenAI
CVE-2026-117882 BR2026-0000-037652 unclaimed
High: Use-after-free in the Layout component
Credited as Amy Burnett of OpenAI
CVE-2026-117883 BR2026-0000-037653 unclaimed
High: Use-after-free in the DOM: HTML Parser component
Credited as Amy Burnett of OpenAI
CVE-2026-117884 BR2026-0000-037654 unclaimed
High: Use-after-free in the Networking component
Credited as Mozilla
CVE-2026-117885 BR2026-0000-037655 unclaimed
High: Use-after-free in the Layout: Grid component
Credited as Mozilla
CVE-2026-117886 BR2026-0000-037656 unclaimed
High: Incorrect boundary conditions in the Graphics: Text component
Credited as tsui
CVE-2026-117887 BR2026-0000-037657 unclaimed
High: Use-after-free in the DOM: Core & HTML component
Credited as Mozilla
CVE-2026-118010 BR2026-0000-037658 unclaimed
High: Use-after-free in the Disability Access APIs component
Credited as Mozilla
CVE-2026-117888 BR2026-0000-037659 unclaimed
High: Uninitialized memory in the Graphics: Canvas2D component
Credited as Minseong Kim
CVE-2026-117889 BR2026-0000-037660 unclaimed
High: Incorrect boundary conditions in the JavaScript Engine component
Credited as Mozilla
CVE-2026-117890 BR2026-0000-037661 unclaimed
High: JIT miscompilation in the JavaScript Engine: JIT component
Credited as Mozilla
CVE-2026-117891 BR2026-0000-037662 unclaimed
High: Use-after-free in the JavaScript Engine: JIT component
Credited as Mozilla
CVE-2026-117892 BR2026-0000-037663 unclaimed
High: Privilege escalation due to use-after-free in the WebRTC: Networking component
Credited as Mozilla
CVE-2026-117893 BR2026-0000-037664 unclaimed
High: Incorrect boundary conditions in the Security: PSM component
Credited as Mozilla
CVE-2026-117894 BR2026-0000-037665 unclaimed
High: Incorrect boundary conditions in the WebRTC: Signaling component
Credited as Mozilla
CVE-2026-117895 BR2026-0000-037666 unclaimed
High: Use-after-free in the DOM: Core & HTML component
Credited as Mozilla
CVE-2026-117896 BR2026-0000-037667 unclaimed
High: Use-after-free in the DOM: Core & HTML component
Credited as Mozilla
CVE-2026-117897 BR2026-0000-037668 unclaimed
High: Incorrect boundary conditions in the Layout: Tables component
Credited as Mozilla
CVE-2026-117898 BR2026-0000-037669 unclaimed
High: Use-after-free in the JavaScript Engine: JIT component
Credited as Mozilla
CVE-2026-117899 BR2026-0000-037670 unclaimed
High: Use-after-free in the Networking: HTTP component
Credited as Mozilla
CVE-2026-117900 BR2026-0000-037671 unclaimed
High: Use-after-free in the DOM: Editor component
Credited as Mozilla
CVE-2026-117901 BR2026-0000-037672 unclaimed
High: Use-after-free in the DOM: Core & HTML component
Credited as Mozilla
CVE-2026-117902 BR2026-0000-037673 unclaimed
High: Use-after-free in the Layout: Text and Fonts component
Credited as Mozilla
CVE-2026-117903 BR2026-0000-037674 unclaimed
High: Use-after-free in the Audio/Video component
Credited as Mozilla