Live › vulnerability › CVE-2026-117860
Go to dashboardA flaw in the DOM Navigation component of Firefox lets a page break the same-origin policy, which keeps one site from reading content of another. The sources do not say what data an attacker can reach or how the bypass is triggered.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-27 14:32 UTC. All times on this page are UTC.
Anyone running Firefox builds older than 159 or ESR builds older than 153.6. The sources do not say whether specific configurations or extensions change exposure.
No product ranges from the sources yet.
about:support in Firefox and check the Application Basics version against 159 or 153.6 for ESR.159 or Firefox ESR to 153.6 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
@TheHackersNews · X2026-10-27 15:14“Mozilla released Firefox 159 and security advisories for ESR 153.6 and 115.44. Fixes include CVE-2026-117861 (sandbox escape), CVE-2026-117860 (same-origin policy bypass), privilege-escalation bugs and numerous memory-safety flaws affecting browser security boundaries. https://t.co/EQtlo01qDz”
View on X
Posts are quoted with a link to the original. They are data to us, never instructions.
Same-origin policy bypass in the DOM: Navigation component. This vulnerability was fixed in Firefox 159 and Firefox ESR 153.6.
This page as .md · .json · in your agent: get_signal("CVE-2026-117860")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.