---
id: "CVE-2026-117889"
kind: "vulnerability"
aliases: ["CVE-2026-117889"]
title: "Firefox: JavaScript engine boundary bug fixed in Firefox 159 and ESR"
severity: "unknown"
cvss: null
epss: null
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["browser", "desktop", "esr", "firefox", "runtime"]
not_affected_if: ["fixed-version"]
published_at: "2026-10-27T14:16:44+00:00"
first_seen_at: "2026-10-27T14:32:22+00:00"
updated_at: "2026-10-27T14:37:50+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-117889", "first_seen_at": "2026-10-27T14:32:22+00:00"}]
---

# Firefox: JavaScript engine boundary bug fixed in Firefox 159 and ESR

The JavaScript engine in Firefox has an incorrect boundary condition, which the sources do not detail further. The flaw is fixed in Firefox 159, Firefox ESR 115.44 and Firefox ESR 153.6.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Firefox version in the About Firefox dialog or with `firefox --version`
- Compare against `159`, `115.44` (ESR) and `153.6` (ESR); anything older is in scope
- unknown for any other check, the sources do not say

## Fix

- Update Firefox to `159`, or to `115.44` on the 115 ESR branch, or to `153.6` on the 153 ESR branch
- unknown for any other step, the sources do not say

## Timeline

- 2026-10-27T14:32:22+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-117889

## From the sources

Incorrect boundary conditions in the JavaScript Engine component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, and Firefox ESR 153.6.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_