CVE-2026-117924 in Firefox
Summary
by MITRE • 10/27/2026
Use-after-free in the XSLT component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, and Firefox ESR 153.6.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/27/2026
The identified security flaw represents a critical memory management error within the Extensible Stylesheet Language Transformations (XSLT) processing engine of Mozilla Firefox browsers. Specifically classified as an use-after-free vulnerability, this issue arises when the application attempts to access or manipulate a block of memory that has already been deallocated by the system. In the context of XSLT transformations, which involve complex parsing and manipulation of XML documents into other formats such as HTML, the engine must dynamically allocate and release various data structures representing nodes, templates, and processing instructions. A failure in properly managing the lifecycle of these objects can lead to a scenario where a pointer remains valid in code logic but points to freed memory space. This discrepancy creates an unstable state within the browser's execution environment, potentially allowing for arbitrary read or write operations depending on how the freed memory is subsequently reused by other processes or allocations.
From a technical perspective, this vulnerability falls under the Common Weakness Enumeration category CWE-416, which defines use-after-free errors as a significant class of software defects that compromise memory safety. The exploitation potential is particularly severe because XSLT processors often handle untrusted input from web pages. An attacker could craft a malicious XML document containing specific XSL stylesheets designed to trigger the race condition or logic error during transformation. By carefully controlling the timing and content of these transformations, an adversary might achieve arbitrary code execution within the context of the browser process. This capability effectively bypasses standard sandboxing mechanisms if the exploit successfully escalates privileges from the renderer process to a higher-level system access, potentially leading to full device compromise.
The operational impact of this vulnerability extends beyond individual user sessions to broader organizational security postures. If exploited in the wild, it could facilitate drive-by download attacks where users are redirected or coerced into downloading malicious payloads without explicit interaction. Furthermore, such vulnerabilities can be leveraged for cross-site scripting amplification or session hijacking if memory corruption leads to leakage of sensitive cookies or authentication tokens stored in browser memory. The risk is compounded by the widespread adoption of Firefox as a primary web client across enterprise environments, making timely patching essential to maintain integrity and confidentiality standards.
To mitigate this threat, organizations must ensure that all endpoints running Mozilla Firefox are updated immediately to version 159 for standard releases or versions 115.44 and 153.6 for Extended Support Release channels. These updates contain the necessary code corrections to enforce proper memory deallocation protocols within the XSLT engine. In addition to patching, security teams should implement strict content security policies that restrict inline scripts and external resource loading where possible, reducing the attack surface available to potential exploiters. Monitoring browser telemetry for unusual spikes in XML parsing activity or unexpected process behavior can also serve as an early detection mechanism for attempted exploitation attempts before they result in successful compromise.