CVEsMozillaCVE-2026-118026Published Oct 27, 14:06 · Updated Oct 27, 18:18 UTC
–
Not scored
CVE-2026-118026

Invalid pointer in the JavaScript: GC component

Firefox
AffectedFirefox, Thunderbird
FixUpdate to 159 or newer
PublishedOct 27, 14:06 · mozilla
ScoredNot yet
Exploit code publicNone known · checked 21:18 UTC
ExploitedNone known · CISA KEV checked 22:04 UTC

What we know

No known exploitation. CISA KEV, checked 22:04 UTC.
No public exploit code known. Exploit-DB, Metasploit, Nuclei, checked 21:18 UTC.
No severity score yet.

Description

Invalid pointer in the JavaScript: GC component. This vulnerability was fixed in Firefox 159 and Thunderbird 159.

From mozilla

Affected and fixed versions

ProductAffectedFixed inFirefoxNot affected159ThunderbirdNot affected159

Exploit code

Exploit-DBnone knownMetasploitnone knownNucleinone known

References

bugzilla.mozilla.org/show_bug.cgi?id=2077075 · bugzilla.mozilla.orgwww.mozilla.org/security/advisories/mfsa2026-118/ · mozilla.orgwww.mozilla.org/security/advisories/mfsa2026-121/ · mozilla.org

Other CVEs in Firefox

All 1,852 →
–Frame poisoning in the Layout component · CVE-2026-118027Oct 27–Other issue in the SVG component · CVE-2026-118025Oct 27–Use-after-free in the Graphics: Text component · CVE-2026-118024Oct 27