{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-117997", "assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe", "state": "PUBLISHED", "assignerShortName": "mozilla", "dateReserved": "2026-10-27T14:05:54.652Z", "datePublished": "2026-10-27T14:05:54.821Z", "dateUpdated": "2026-10-27T18:30:24.710Z"}, "containers": {"cna": {"affected": [{"product": "Firefox", "vendor": "Mozilla", "versions": [{"status": "unaffected", "version": "153.6", "lessThanOrEqual": "153.*", "versionType": "rpm"}, {"status": "unaffected", "version": "159", "lessThanOrEqual": "*", "versionType": "rpm"}]}, {"product": "Thunderbird", "vendor": "Mozilla", "versions": [{"status": "unaffected", "version": "153.6", "lessThanOrEqual": "153.*", "versionType": "rpm"}, {"status": "unaffected", "version": "159", "lessThanOrEqual": "*", "versionType": "rpm"}]}], "descriptions": [{"lang": "en", "value": "Sandbox escape due to use-after-free in the Widget component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "Sandbox escape due to use-after-free in the Widget component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6."}]}], "title": "Sandbox escape due to use-after-free in the Widget component", "references": [{"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2081560"}, {"url": "https://www.mozilla.org/security/advisories/mfsa2026-118/"}, {"url": "https://www.mozilla.org/security/advisories/mfsa2026-120/"}, {"url": "https://www.mozilla.org/security/advisories/mfsa2026-121/"}, {"url": "https://www.mozilla.org/security/advisories/mfsa2026-122/"}], "credits": [{"lang": "en", "value": "Mozilla"}], "providerMetadata": {"orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe", "shortName": "mozilla", "dateUpdated": "2026-10-27T18:30:24.710Z"}}}}

{}

{"affected": [{"affectedData": [{"product": "Firefox", "vendor": "Mozilla", "versions": [{"lessThanOrEqual": "153.*", "status": "unaffected", "version": "153.6", "versionType": "rpm"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "159", "versionType": "rpm"}]}, {"product": "Thunderbird", "vendor": "Mozilla", "versions": [{"lessThanOrEqual": "153.*", "status": "unaffected", "version": "153.6", "versionType": "rpm"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "159", "versionType": "rpm"}]}], "source": "security@mozilla.org"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Sandbox escape due to use-after-free in the Widget component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6."}], "id": "CVE-2026-117997", "lastModified": "2026-10-27T19:17:25.587", "metrics": {}, "published": "2026-10-27T14:16:57.607", "references": [{"source": "security@mozilla.org", "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2081560"}, {"source": "security@mozilla.org", "url": "https://www.mozilla.org/security/advisories/mfsa2026-118/"}, {"source": "security@mozilla.org", "url": "https://www.mozilla.org/security/advisories/mfsa2026-120/"}, {"source": "security@mozilla.org", "url": "https://www.mozilla.org/security/advisories/mfsa2026-121/"}, {"source": "security@mozilla.org", "url": "https://www.mozilla.org/security/advisories/mfsa2026-122/"}], "sourceIdentifier": "security@mozilla.org", "vulnStatus": "Deferred"}

{"bugzilla": {"description": "firefox: firefox: Sandbox escape via use-after-free in the Widget component", "id": "2562250", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2562250"}, "csaw": false, "cvss3": {"cvss3_base_score": "8.8", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-825", "details": ["Sandbox escape due to use-after-free in the Widget component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.", "A flaw was found in Firefox. A use-after-free memory corruption issue in the Widget component occurs when the application attempts to reuse memory after it has already been released. An attacker could exploit this vulnerability, such as through a malicious web page, to escape the browser's restricted sandbox environment and execute arbitrary code on the underlying operating system."], "name": "CVE-2026-117997", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "firefox", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Affected", "package_name": "firefox", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "firefox", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "firefox", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-10-27T14:05:54Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-117997\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-117997\nhttps://bugzilla.mozilla.org/show_bug.cgi?id=2081560\nhttps://www.mozilla.org/security/advisories/mfsa2026-118/\nhttps://www.mozilla.org/security/advisories/mfsa2026-120/"], "threat_severity": "Important"}