{"id":"CVE-2026-117889","kind":"vulnerability","aliases":["CVE-2026-117889"],"related":[],"title":"Firefox: JavaScript engine boundary bug fixed in Firefox 159 and ESR","description":"Incorrect boundary conditions in the JavaScript Engine component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, and Firefox ESR 153.6.","summary":"The JavaScript engine in Firefox has an incorrect boundary condition, which the sources do not detail further. The flaw is fixed in Firefox 159, Firefox ESR 115.44 and Firefox ESR 153.6.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["browser","desktop","esr","firefox","runtime"],"not_affected_if":["fixed-version"],"how_to_check":"- Check the installed Firefox version in the About Firefox dialog or with `firefox --version`\n- Compare against `159`, `115.44` (ESR) and `153.6` (ESR); anything older is in scope\n- unknown for any other check, the sources do not say","fix":"- Update Firefox to `159`, or to `115.44` on the 115 ESR branch, or to `153.6` on the 153 ESR branch\n- unknown for any other step, the sources do not say","status":"open","published_at":"2026-10-27T14:16:44+00:00","first_seen_at":"2026-10-27T14:32:22+00:00","triaged_at":"2026-10-27T14:37:50+00:00","updated_at":"2026-10-27T14:37:50+00:00","category":"runtime","confidence":0.4,"triage":{"at":"2026-10-27T14:37:50Z","model":"claude-haiku-5-5","output":{"fix":"- Update Firefox to `159`, or to `115.44` on the 115 ESR branch, or to `153.6` on the 153 ESR branch\n- unknown for any other step, the sources do not say","reach":"unknown","title":"Firefox: JavaScript engine boundary bug fixed in Firefox 159 and ESR","impact":"medium","summary":"The JavaScript engine in Firefox has an incorrect boundary condition, which the sources do not detail further. The flaw is fixed in Firefox 159, Firefox ESR 115.44 and Firefox ESR 153.6.","category":"runtime","nicknames":[],"who_cares":["firefox","desktop","browser","esr"],"confidence":0.4,"needs_auth":"unknown","worst_case":"unknown; the sources do not state the impact","analyst_note":"Check the Mozilla security advisory for this CVE for the bug's impact, trigger conditions and whether it is exploitable from web content; the NVD entry gives only the description.","how_to_check":"- Check the installed Firefox version in the About Firefox dialog or with `firefox --version`\n- Compare against `159`, `115.44` (ESR) and `153.6` (ESR); anything older is in scope\n- unknown for any other check, the sources do not say","needs_analyst":true,"not_affected_if":["fixed-version"],"who_is_affected":"Anyone running Firefox or Firefox ESR builds older than the fixed versions, on desktop or in managed fleets that pin ESR releases. The sources do not say whether the flaw is reachable from web content or only from specific features, so the exact exposure is unknown. Teams that already run the fixed versions can skip it.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000634,"input_tokens":3260,"output_tokens":616,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-117889':14A,17A '-2026':13A,16A '115.44':49B,71C '153.6':53B,75C '159':9A,46B,68C 'boundari':4A,31B,55C 'browser':18B 'bug':5A 'compon':61C 'condit':32B,56C 'cve':12A,15A 'desktop':19B 'detail':38B 'engin':3A,25B,60C 'esr':11A,20B,48B,52B,70C,74C 'firefox':1A,8A,21B,27B,45B,47B,51B,67C,69C,73C 'fix':6A,43B,65C 'flaw':41B 'incorrect':30B,54C 'javascript':2A,24B,59C 'runtim':22B 'sourc':35B 'vulner':63C","nicknames":[],"mitigations":[],"who_affected":"Anyone running Firefox or Firefox ESR builds older than the fixed versions, on desktop or in managed fleets that pin ESR releases. The sources do not say whether the flaw is reachable from web content or only from specific features, so the exact exposure is unknown. Teams that already run the fixed versions can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-27T14:16:44+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-117889","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117889","severity":null,"published_at":"2026-10-27T14:16:44+00:00","modified_at":"2026-10-27T14:16:44+00:00","first_seen_at":"2026-10-27T14:32:22+00:00","fetched_at":"2026-10-27T14:32:22+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}