{"id":"CVE-2026-117912","kind":"vulnerability","aliases":["CVE-2026-117912"],"related":[],"title":"Firefox: CSS parsing flaw lets pages bypass the same-origin policy","description":"Same-origin policy bypass in the CSS Parsing and Computation component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, and Firefox ESR 153.6.","summary":"A flaw in Firefox's CSS Parsing and Computation component breaks the same-origin policy, which keeps one website from reading another site's data. The sources do not say what data an attacker can reach or how reliably.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["browsers","desktop","firefox","runtime"],"not_affected_if":["fixed-version"],"how_to_check":"- Check the installed Firefox version in Help > About Firefox, or run `firefox --version`\n- Compare against the fixed releases: Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6","fix":"- Update Firefox to `159` or later\n- Update Firefox ESR to `115.44` or `153.6`, or later on the matching branch","status":"open","published_at":"2026-10-27T14:16:46+00:00","first_seen_at":"2026-10-27T14:32:22+00:00","triaged_at":"2026-10-27T14:37:27+00:00","updated_at":"2026-10-27T14:37:27+00:00","category":"runtime","confidence":0.5,"triage":{"at":"2026-10-27T14:37:27Z","model":"claude-haiku-5-5","output":{"fix":"- Update Firefox to `159` or later\n- Update Firefox ESR to `115.44` or `153.6`, or later on the matching branch","reach":"internet","title":"Firefox: CSS parsing flaw lets pages bypass the same-origin policy","impact":"medium","summary":"A flaw in Firefox's CSS Parsing and Computation component breaks the same-origin policy, which keeps one website from reading another site's data. The sources do not say what data an attacker can reach or how reliably.","category":"runtime","nicknames":[],"who_cares":["firefox","browsers","desktop"],"confidence":0.5,"needs_auth":"unknown","worst_case":"A malicious web page reads data from another site","analyst_note":"Check the Mozilla security advisory for this CVE to confirm the exploit conditions and the affected version ranges; NVD text alone is thin.","how_to_check":"- Check the installed Firefox version in Help > About Firefox, or run `firefox --version`\n- Compare against the fixed releases: Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6","needs_analyst":true,"not_affected_if":["fixed-version"],"who_is_affected":"Anyone running Firefox builds older than the fixed versions, on desktop or in a deployment that ships Firefox. The sources do not say which configurations or content types trigger the flaw, so it is unknown whether a site that does not load untrusted content can skip the update.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000597,"input_tokens":3264,"output_tokens":542,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-117912':15A,18A '-2026':14A,17A '115.44':84C '153.6':88C '159':81C 'anoth':45B 'attack':57B 'break':33B 'browser':19B 'bypass':7A,67C 'compon':32B,74C 'comput':31B,73C 'css':2A,28B,70C 'cve':13A,16A 'data':48B,55B 'desktop':20B 'esr':83C,87C 'firefox':1A,21B,26B,80C,82C,86C 'fix':78C 'flaw':4A,24B 'keep':40B 'let':5A 'one':41B 'origin':11A,37B,65C 'page':6A 'pars':3A,29B,71C 'polici':12A,38B,66C 'reach':59B 'read':44B 'reliabl':62B 'runtim':22B 'same-origin':9A,35B,63C 'say':53B 'site':46B 'sourc':50B 'vulner':76C 'websit':42B","nicknames":[],"mitigations":[],"who_affected":"Anyone running Firefox builds older than the fixed versions, on desktop or in a deployment that ships Firefox. The sources do not say which configurations or content types trigger the flaw, so it is unknown whether a site that does not load untrusted content can skip the update.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-27T14:16:46+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-117912","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117912","severity":null,"published_at":"2026-10-27T14:16:46+00:00","modified_at":"2026-10-27T14:16:46+00:00","first_seen_at":"2026-10-27T14:32:22+00:00","fetched_at":"2026-10-27T14:32:22+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}