{"id":"CVE-2026-117861","kind":"vulnerability","aliases":["CVE-2026-117861"],"related":[],"title":"Firefox: DOM navigation flaw lets web content escape the sandbox","description":"Sandbox escape in the DOM: Navigation component. This vulnerability was fixed in Firefox 159 and Firefox ESR 153.6.","summary":"A flaw in the DOM Navigation component of Firefox allows a sandbox escape. The sources do not say what an attacker can reach after escaping.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["browsers","desktop","firefox","firefox-esr","runtime"],"not_affected_if":["other-browser-only"],"how_to_check":"- Check the installed Firefox version (Help > About Firefox, or `firefox --version`) and compare it with the fixed releases.\n- Check whether Firefox ESR is in use and confirm its version against the fixed ESR release.","fix":"- Update Firefox to `159` or later.\n- Update Firefox ESR to `153.6` or later.","status":"open","published_at":"2026-10-27T14:16:40+00:00","first_seen_at":"2026-10-27T14:32:21+00:00","triaged_at":"2026-10-27T14:39:23+00:00","updated_at":"2026-10-27T14:39:23+00:00","category":"runtime","confidence":0.4,"triage":{"at":"2026-10-27T14:39:23Z","model":"claude-haiku-5-5","output":{"fix":"- Update Firefox to `159` or later.\n- Update Firefox ESR to `153.6` or later.","reach":"internet","title":"Firefox: DOM navigation flaw lets web content escape the sandbox","impact":"high","summary":"A flaw in the DOM Navigation component of Firefox allows a sandbox escape. The sources do not say what an attacker can reach after escaping.","category":"runtime","nicknames":[],"who_cares":["firefox","firefox-esr","browsers","desktop"],"confidence":0.4,"needs_auth":"unknown","worst_case":"unknown, sources do not describe the escape's reach","analyst_note":"Confirm the sandbox escape details and whether it is exploited in the wild using the Mozilla security advisory for Firefox 159 and ESR 153.6, and the NVD entry.","how_to_check":"- Check the installed Firefox version (Help > About Firefox, or `firefox --version`) and compare it with the fixed releases.\n- Check whether Firefox ESR is in use and confirm its version against the fixed ESR release.","needs_analyst":true,"not_affected_if":["other-browser-only"],"who_is_affected":"Any team with Firefox or Firefox ESR installed on workstations or managed browsers is potentially affected, since the flaw is in the browser itself. The sources do not say whether any particular configuration or site content is required to trigger it. Systems running only other browsers can skip it.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000592,"input_tokens":3240,"output_tokens":536,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-117861':13A,16A '-2026':12A,15A '153.6':66C '159':62C 'allow':33B 'attack':44B 'browser':17B 'compon':30B,55C 'content':7A 'cve':11A,14A 'desktop':18B 'dom':2A,28B,53C 'escap':8A,36B,48B,50C 'esr':22B,65C 'firefox':1A,19B,21B,32B,61C,64C 'firefox-esr':20B 'fix':59C 'flaw':4A,25B 'let':5A 'navig':3A,29B,54C 'reach':46B 'runtim':23B 'sandbox':10A,35B,49C 'say':41B 'sourc':38B 'vulner':57C 'web':6A","nicknames":[],"mitigations":[],"who_affected":"Any team with Firefox or Firefox ESR installed on workstations or managed browsers is potentially affected, since the flaw is in the browser itself. The sources do not say whether any particular configuration or site content is required to trigger it. Systems running only other browsers can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-27T14:16:40+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-117861","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117861","severity":null,"published_at":"2026-10-27T14:16:40+00:00","modified_at":"2026-10-27T14:16:40+00:00","first_seen_at":"2026-10-27T14:32:21+00:00","fetched_at":"2026-10-27T14:32:21+00:00","note":null}],"documents":[{"id":6715,"url":"https://x.com/TheHackersNews/status/2115099732444119324","title":"@TheHackersNews: Mozilla released Firefox 159 and security advisories for ESR 153.6 and 115.44.\n\n","kind":"post","source":"x","text":"Mozilla released Firefox 159 and security advisories for ESR 153.6 and 115.44.\n\nFixes include CVE-2026-117861 (sandbox escape), CVE-2026-117860 (same-origin policy bypass), privilege-escalation bugs and numerous memory-safety flaws affecting browser security boundaries. https://t.co/EQtlo01qDz\n\nlikes 0 reposts 0","published_at":"2026-10-27T15:14:07+00:00","relation":"discussion","confidence":null,"note":"@TheHackersNews"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}