BugRater
Early access. The directory is still filling out, and every rating here comes from a researcher's reported experience.

Security releases

Mozilla

Security Vulnerabilities fixed in Firefox 159

MFSA2026-118 Oct 27, 2026 Source: Vendor

Imported from Mozilla security advisory MFSA2026-118. Draft.

Source of record The credited names below are quoted verbatim from the vendor's own advisory: https://www.mozilla.org/en-US/security/advisories/mfsa2026-118/
Are you credited here? Sign in to claim your line. It is yours immediately, with no review queue. The name the vendor printed stays next to your handle for anyone to check against the advisory above, and any member who thinks a claim is wrong can refute it.

Credited

167 lines
All 167 CVEs 167 Additional recognition 0 Unclaimed only
Showing 51–100 of 167 , page 2 of 4
CVE-2026-117904 BR2026-0000-037675 unclaimed
High: Use-after-free in the JavaScript: GC component
Credited as Mozilla
CVE-2026-117905 BR2026-0000-037676 unclaimed
High: Use-after-free in the Audio/Video: Playback component
Credited as Mozilla
CVE-2026-117906 BR2026-0000-037677 unclaimed
High: Use-after-free in the CSS Parsing and Computation component
Credited as Mozilla
CVE-2026-117907 BR2026-0000-037678 unclaimed
High: Use-after-free in the Networking component
Credited as Mozilla
CVE-2026-117908 BR2026-0000-037679 unclaimed
High: Use-after-free in the Graphics: ImageLib component
Credited as Mozilla
CVE-2026-117909 BR2026-0000-037680 unclaimed
High: Use-after-free in the JavaScript: GC component
Credited as Mozilla
CVE-2026-117910 BR2026-0000-037681 unclaimed
High: Invalid pointer in the JavaScript Engine component
Credited as Mozilla
CVE-2026-117911 BR2026-0000-037682 unclaimed
High: Use-after-free in the Audio/Video: Playback component
Credited as Mozilla
CVE-2026-117912 BR2026-0000-037683 unclaimed
High: Same-origin policy bypass in the CSS Parsing and Computation component
Credited as Takashi Suzuki
CVE-2026-117913 BR2026-0000-037684 unclaimed
High: Use-after-free in the SVG component
Credited as Mozilla
CVE-2026-117914 BR2026-0000-037685 unclaimed
High: Use-after-free in the SVG component
Credited as Mozilla
CVE-2026-117915 BR2026-0000-037686 unclaimed
High: Incorrect boundary conditions in the Layout: Block and Inline component
Credited as Mozilla
CVE-2026-117916 BR2026-0000-037687 unclaimed
High: Use-after-free in the XSLT component
Credited as Mozilla
CVE-2026-117917 BR2026-0000-037688 unclaimed
High: Invalid pointer in the Graphics: WebRender component
Credited as Nguyen Tuan Hung
CVE-2026-117918 BR2026-0000-037689 unclaimed
High: Use-after-free in the Graphics: Canvas2D component
Credited as Mozilla
CVE-2026-117919 BR2026-0000-037690 unclaimed
High: Use-after-free in the DOM: Core & HTML component
Credited as Mozilla
CVE-2026-117920 BR2026-0000-037691 unclaimed
High: Use-after-free in the DOM: HTML Parser component
Credited as Mozilla
CVE-2026-117921 BR2026-0000-037692 unclaimed
High: Use-after-free in the CSS Parsing and Computation component
Credited as OpenAI Codex Security (kylebot)
CVE-2026-117922 BR2026-0000-037693 unclaimed
High: Use-after-free in the Networking: WebSockets component
Credited as OpenAI Codex Security (kylebot)
CVE-2026-117923 BR2026-0000-037694 unclaimed
High: Use-after-free in the Audio/Video component
Credited as Mozilla
CVE-2026-117924 BR2026-0000-037695 unclaimed
High: Use-after-free in the XSLT component
Credited as Mozilla
CVE-2026-117925 BR2026-0000-037696 unclaimed
High: Use-after-free in the DOM: Core & HTML component
Credited as Mozilla
CVE-2026-117926 BR2026-0000-037697 unclaimed
High: Incorrect boundary conditions in the SVG component
Credited as Mozilla
CVE-2026-117927 BR2026-0000-037698 unclaimed
High: Use-after-free in the SVG component
Credited as Mozilla
CVE-2026-117928 BR2026-0000-037699 unclaimed
High: Same-origin policy bypass in the CSS Parsing and Computation component
Credited as Minseong Kim
CVE-2026-117929 BR2026-0000-037700 unclaimed
High: Use-after-free in the DOM: Core & HTML component
Credited as Mozilla
CVE-2026-117930 BR2026-0000-037701 unclaimed
High: Use-after-free in the DOM: Bindings (WebIDL) component
Credited as OpenAI Codex Security (kylebot)
CVE-2026-117931 BR2026-0000-037702 unclaimed
High: Use-after-free in the DOM: Events component
Credited as OpenAI Codex Security (kylebot)
CVE-2026-117932 BR2026-0000-037703 unclaimed
High: Use-after-free in the DOM: Core & HTML component
Credited as OpenAI Codex Security (kylebot)
CVE-2026-117933 BR2026-0000-037704 unclaimed
High: Frame poisoning in the CSS Parsing and Computation component
Credited as OpenAI Codex Security (kylebot)
CVE-2026-117934 BR2026-0000-037705 unclaimed
High: Use-after-free in the Layout component
Credited as OpenAI Codex Security (kylebot)
CVE-2026-118011 BR2026-0000-037706 unclaimed
High: Frame poisoning in the CSS Parsing and Computation component
Credited as OpenAI Codex Security (kylebot)
CVE-2026-118012 BR2026-0000-037707 unclaimed
High: Use-after-free in the DOM: Animation component
Credited as OpenAI Codex Security (kylebot)
CVE-2026-117935 BR2026-0000-037708 unclaimed
High: Use-after-free in the DOM: Bindings (WebIDL) component
Credited as OpenAI Codex Security (kylebot)
CVE-2026-117936 BR2026-0000-037709 unclaimed
High: Use-after-free in the DOM: Core & HTML component
Credited as OpenAI Codex Security (kylebot)
CVE-2026-117937 BR2026-0000-037710 unclaimed
High: Invalid pointer in the JavaScript Engine component
Credited as OpenAI Codex Security (kylebot)
CVE-2026-117938 BR2026-0000-037711 unclaimed
High: Use-after-free in the Layout component
Credited as OpenAI Codex Security (kylebot)
CVE-2026-117939 BR2026-0000-037712 unclaimed
High: Use-after-free in the XML component
Credited as OpenAI Codex Security (kylebot)
CVE-2026-117940 BR2026-0000-037713 unclaimed
High: Use-after-free in the DOM: Core & HTML component
Credited as OpenAI Codex Security (kylebot)
CVE-2026-118013 BR2026-0000-037714 unclaimed
High: Use-after-free in the Layout: Images, Video, and HTML Frames component
Credited as OpenAI Codex Security (kylebot)
CVE-2026-117941 BR2026-0000-037715 unclaimed
High: Use-after-free in the DOM: CSS Object Model component
Credited as OpenAI Codex Security (kylebot)
CVE-2026-117942 BR2026-0000-037716 unclaimed
High: Incorrect boundary conditions in the JavaScript Engine: JIT component
Credited as OpenAI Codex Security (kylebot)
CVE-2026-118014 BR2026-0000-037717 unclaimed
High: Use-after-free in the JavaScript Engine: JIT component
Credited as OpenAI Codex Security (kylebot)
CVE-2026-117943 BR2026-0000-037718 unclaimed
High: Use-after-free in the DOM: Core & HTML component
Credited as OpenAI Codex Security (kylebot)
CVE-2026-117944 BR2026-0000-037719 unclaimed
High: Use-after-free in the Layout component
Credited as OpenAI Codex Security (kylebot)
CVE-2026-118015 BR2026-0000-037720 unclaimed
High: Use-after-free in the DOM: Core & HTML component
Credited as OpenAI Codex Security (kylebot)
CVE-2026-117945 BR2026-0000-037721 unclaimed
High: Incorrect boundary conditions in the XML component
Credited as OpenAI Codex Security (kylebot)
CVE-2026-118016 BR2026-0000-037722 unclaimed
High: Use-after-free in the DOM: Core & HTML component
Credited as OpenAI Codex Security (kylebot)
CVE-2026-117946 BR2026-0000-037723 unclaimed
High: Incorrect boundary conditions in the JavaScript Engine component
Credited as OpenAI Codex Security (kylebot)
CVE-2026-117947 BR2026-0000-037724 unclaimed
High: Use-after-free in the XML component
Credited as OpenAI Codex Security (kylebot)