Overview
WebIDL bindings are the generated code that connects JavaScript objects to Firefox's C++ DOM implementation. An object lifetime bug in that layer leaves a pointer that no longer points at a live object.
A web page manipulates DOM objects in a sequence that dereferences the stale pointer and corrupts memory. NVD scores it 9.8. Mozilla fixed it in Firefox 153, Firefox ESR 115.38 and 140.13, and Thunderbird 153 and 140.13 on 21 July 2026.
Affected products
- Firefox before 153
- Firefox ESR before 115.38 and 140.13
- Thunderbird before 153 and 140.13
Disclosure timeline
- 21 Jul 2026
- Mozilla publishes MFSA 2026-68 through 2026-72; fixed releases ship