{"id":"CVE-2026-117860","kind":"vulnerability","aliases":["CVE-2026-117860"],"related":[],"title":"Firefox: Navigation component lets pages bypass same-origin policy","description":"Same-origin policy bypass in the DOM: Navigation component. This vulnerability was fixed in Firefox 159 and Firefox ESR 153.6.","summary":"A flaw in the DOM Navigation component of Firefox lets a page break the same-origin policy, which keeps one site from reading content of another. The sources do not say what data an attacker can reach or how the bypass is triggered.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["browsers","desktop","firefox","other"],"not_affected_if":["firefox-159-or-later","firefox-esr-153.6-or-later"],"how_to_check":"- Run `about:support` in Firefox and check the Application Basics version against `159` or `153.6` for ESR.\n- unknown","fix":"- Update Firefox to `159` or Firefox ESR to `153.6` or later.","status":"open","published_at":"2026-10-27T14:16:40+00:00","first_seen_at":"2026-10-27T14:32:21+00:00","triaged_at":"2026-10-27T14:39:25+00:00","updated_at":"2026-10-27T14:39:25+00:00","category":"other","confidence":0.4,"triage":{"at":"2026-10-27T14:39:25Z","model":"claude-haiku-5-5","output":{"fix":"- Update Firefox to `159` or Firefox ESR to `153.6` or later.","reach":"internet","title":"Firefox: Navigation component lets pages bypass same-origin policy","impact":"medium","summary":"A flaw in the DOM Navigation component of Firefox lets a page break the same-origin policy, which keeps one site from reading content of another. The sources do not say what data an attacker can reach or how the bypass is triggered.","category":"other","nicknames":[],"who_cares":["firefox","browsers","desktop"],"confidence":0.4,"needs_auth":"unknown","worst_case":"unknown; sources do not say what data is exposed","analyst_note":"Check the Mozilla security advisory for the Firefox 159 release to confirm the bypass impact and user interaction required.","how_to_check":"- Run `about:support` in Firefox and check the Application Basics version against `159` or `153.6` for ESR.\n- unknown","needs_analyst":true,"not_affected_if":["firefox-159-or-later","firefox-esr-153.6-or-later"],"who_is_affected":"Anyone running Firefox builds older than 159 or ESR builds older than 153.6. The sources do not say whether specific configurations or extensions change exposure.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.00056,"input_tokens":3246,"output_tokens":470,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-117860':13A,16A '-2026':12A,15A '153.6':84C '159':80C 'anoth':46B 'attack':55B 'break':32B 'browser':17B 'bypass':6A,61B,68C 'compon':3A,26B,73C 'content':44B 'cve':11A,14A 'data':53B 'desktop':18B 'dom':24B,71C 'esr':83C 'firefox':1A,19B,28B,79C,82C 'fix':77C 'flaw':21B 'keep':39B 'let':4A,29B 'navig':2A,25B,72C 'one':40B 'origin':9A,36B,66C 'page':5A,31B 'polici':10A,37B,67C 'reach':57B 'read':43B 'same-origin':7A,34B,64C 'say':51B 'site':41B 'sourc':48B 'trigger':63B 'vulner':75C","nicknames":[],"mitigations":[],"who_affected":"Anyone running Firefox builds older than 159 or ESR builds older than 153.6. The sources do not say whether specific configurations or extensions change exposure.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-27T14:16:40+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-117860","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117860","severity":null,"published_at":"2026-10-27T14:16:40+00:00","modified_at":"2026-10-27T14:16:40+00:00","first_seen_at":"2026-10-27T14:32:21+00:00","fetched_at":"2026-10-27T14:32:21+00:00","note":null}],"documents":[{"id":6715,"url":"https://x.com/TheHackersNews/status/2115099732444119324","title":"@TheHackersNews: Mozilla released Firefox 159 and security advisories for ESR 153.6 and 115.44.\n\n","kind":"post","source":"x","text":"Mozilla released Firefox 159 and security advisories for ESR 153.6 and 115.44.\n\nFixes include CVE-2026-117861 (sandbox escape), CVE-2026-117860 (same-origin policy bypass), privilege-escalation bugs and numerous memory-safety flaws affecting browser security boundaries. https://t.co/EQtlo01qDz\n\nlikes 0 reposts 0","published_at":"2026-10-27T15:14:07+00:00","relation":"discussion","confidence":null,"note":"@TheHackersNews"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}