---
id: "CVE-2026-117893"
kind: "vulnerability"
aliases: ["CVE-2026-117893"]
title: "Firefox: boundary check flaw in the PSM security component"
severity: "unknown"
cvss: null
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["desktop", "firefox", "firefox-esr", "other"]
not_affected_if: ["already-updated"]
published_at: "2026-10-27T14:16:44+00:00"
first_seen_at: "2026-10-27T14:32:22+00:00"
updated_at: "2026-10-27T14:37:46+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-117893", "first_seen_at": "2026-10-27T14:32:22+00:00"}]
---

# Firefox: boundary check flaw in the PSM security component

Mozilla's Firefox has an incorrect boundary condition in its Security: PSM component, which handles TLS and certificate code. The sources do not say what an attacker gets from it, beyond that it was fixed in Firefox 159 and Firefox ESR 115.44 and 153.6.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Run `firefox --version` (or check About Firefox) and compare against `159` or the ESR builds `115.44` and `153.6`
- Check the ESR line in use, for example with `firefox --version` on managed installs

## Fix

- Update Firefox to `159` or later
- Update Firefox ESR to `115.44` or `153.6`, whichever matches the ESR line in use

## Timeline

- 2026-10-27T14:32:22+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-117893

## From the sources

Incorrect boundary conditions in the Security: PSM component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, and Firefox ESR 153.6.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_