CVE-2026-118006
published 2026-10-27CVE-2026-118006: Privilege escalation due to use-after-free in the WebRTC: Signaling component. This vulnerability was fixed in Firefox 159 and Thunderbird 159.
PriorityP430
EPSS
0.15%
4.2th percentile
Privilege escalation due to use-after-free in the WebRTC: Signaling component. This vulnerability was fixed in Firefox 159 and Thunderbird 159.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| mozilla | firefox | < Firefox 159 | Firefox 159 |
| mozilla | firefox | — | — |
| mozilla | thunderbird | < Thunderbird 159 | Thunderbird 159 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Privilege escalation due to use-after-free in the WebRTC: Signaling component.
ghsa_unreviewed·2026-10-27
CVE-2026-118006 Privilege escalation due to use-after-free in the WebRTC: Signaling component.
Privilege escalation due to use-after-free in the WebRTC: Signaling component. This vulnerability was fixed in Firefox 159.
Red Hat
firefox: firefox: Privilege escalation via use-after-free in WebRTC signaling
vendor_redhat·2026-10-27
CVE-2026-118006 [HIGH] CWE-825 firefox: firefox: Privilege escalation via use-after-free in WebRTC signaling
firefox: firefox: Privilege escalation via use-after-free in WebRTC signaling
Privilege escalation due to use-after-free in the WebRTC: Signaling component. This vulnerability was fixed in Firefox 159 and Thunderbird 159.
A flaw was found in Firefox. A use-after-free vulnerability in the WebRTC (Web Real-Time Communication) signaling component allows an attacker to achieve privilege escalation. By exploiting memory that was previously freed during communication signaling, an attacker can manipulate application memory to gain elevated privileges.
Package: firefox (Red Hat Enterprise Linux 10) - Affected
Package: firefox (Red Hat Enterprise Linux 7) - Affected
Package: firefox (Red Hat Enterprise Linux 8) - Affected
Package: firefox (Red Hat Enterprise Linux 9) - Affected
Mozilla
Mozilla Foundation Security Advisory 2026-118: CVE-2026-118006
vendor_mozilla
CVE-2026-118006 Mozilla Foundation Security Advisory 2026-118: CVE-2026-118006
Mozilla Foundation Security Advisory 2026-118
CVE: CVE-2026-118006
Product: Firefox
Impact: low
Fixed in: Firefox 159
Mozilla
Mozilla Foundation Security Advisory 2026-121: CVE-2026-118006
vendor_mozilla
CVE-2026-118006 Mozilla Foundation Security Advisory 2026-121: CVE-2026-118006
Mozilla Foundation Security Advisory 2026-121
CVE: CVE-2026-118006
Product: Thunderbird
Impact: low
Fixed in: Thunderbird 159
No detection rules found.
No public exploits indexed.
2026-10-27
Published