Live › vulnerability › CVE-2026-117889
Go to dashboardThe JavaScript engine in Firefox has an incorrect boundary condition, which the sources do not detail further. The flaw is fixed in Firefox 159, Firefox ESR 115.44 and Firefox ESR 153.6.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-27 14:32 UTC. All times on this page are UTC.
Anyone running Firefox or Firefox ESR builds older than the fixed versions, on desktop or in managed fleets that pin ESR releases. The sources do not say whether the flaw is reachable from web content or only from specific features, so the exact exposure is unknown. Teams that already run the fixed versions can skip it.
No product ranges from the sources yet.
firefox --version159, 115.44 (ESR) and 153.6 (ESR); anything older is in scope159, or to 115.44 on the 115 ESR branch, or to 153.6 on the 153 ESR branchEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Incorrect boundary conditions in the JavaScript Engine component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, and Firefox ESR 153.6.
This page as .md · .json · in your agent: get_signal("CVE-2026-117889")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.