Live › vulnerability › CVE-2026-117928
Go to dashboardA flaw in how Firefox parses and computes CSS lets content break the same-origin policy that keeps one site from reading another site's data. The sources do not say what an attacker can read or how reliably it can be used.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-27 14:32 UTC. All times on this page are UTC.
Anyone running Firefox or Firefox ESR builds older than the fixed versions, including managed desktops that pin an ESR release. Server teams running Firefox only in CI or headless tests have little exposure beyond the browser itself. The sources do not say whether specific configurations or extensions are needed to trigger it.
No product ranges from the sources yet.
firefox --version; the fix is in Firefox 159 and Firefox ESR 153.6.159 or later.153.6 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Same-origin policy bypass in the CSS Parsing and Computation component. This vulnerability was fixed in Firefox 159 and Firefox ESR 153.6.
This page as .md · .json · in your agent: get_signal("CVE-2026-117928")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.