Live › vulnerability › CVE-2026-117893
Go to dashboardMozilla's Firefox has an incorrect boundary condition in its Security: PSM component, which handles TLS and certificate code. The sources do not say what an attacker gets from it, beyond that it was fixed in Firefox 159 and Firefox ESR 115.44 and 153.6.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-27 14:32 UTC. All times on this page are UTC.
Anyone running Firefox or a Firefox ESR build older than the fixed versions is in scope, since PSM is part of the browser itself rather than a server component. The sources do not say which configurations or content are needed to trigger it. Systems that only run a patched version or a managed browser that auto-updates can skip the manual step.
No product ranges from the sources yet.
firefox --version (or check About Firefox) and compare against 159 or the ESR builds 115.44 and 153.6firefox --version on managed installs159 or later115.44 or 153.6, whichever matches the ESR line in useEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Incorrect boundary conditions in the Security: PSM component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, and Firefox ESR 153.6.
This page as .md · .json · in your agent: get_signal("CVE-2026-117893")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.