{"id":"CVE-2026-117928","kind":"vulnerability","aliases":["CVE-2026-117928"],"related":[],"title":"Firefox: CSS parsing flaw lets pages bypass same-origin policy","description":"Same-origin policy bypass in the CSS Parsing and Computation component. This vulnerability was fixed in Firefox 159 and Firefox ESR 153.6.","summary":"A flaw in how Firefox parses and computes CSS lets content break the same-origin policy that keeps one site from reading another site's data. The sources do not say what an attacker can read or how reliably it can be used.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["desktop","enterprise-esr","firefox","runtime"],"not_affected_if":["firefox-159-or-later","firefox-esr-153.6-or-later"],"how_to_check":"- Check the Firefox version with Help > About Firefox or `firefox --version`; the fix is in Firefox 159 and Firefox ESR 153.6.\n- Check the ESR line in use if the browser is managed by an enterprise policy.","fix":"- Update Firefox to `159` or later.\n- Update Firefox ESR to `153.6` or later.","status":"open","published_at":"2026-10-27T14:16:48+00:00","first_seen_at":"2026-10-27T14:32:23+00:00","triaged_at":"2026-10-27T14:37:11+00:00","updated_at":"2026-10-27T14:37:11+00:00","category":"runtime","confidence":0.4,"triage":{"at":"2026-10-27T14:37:11Z","model":"claude-haiku-5-5","output":{"fix":"- Update Firefox to `159` or later.\n- Update Firefox ESR to `153.6` or later.","reach":"internet","title":"Firefox: CSS parsing flaw lets pages bypass same-origin policy","impact":"medium","summary":"A flaw in how Firefox parses and computes CSS lets content break the same-origin policy that keeps one site from reading another site's data. The sources do not say what an attacker can read or how reliably it can be used.","category":"runtime","nicknames":[],"who_cares":["firefox","desktop","enterprise-esr"],"confidence":0.4,"needs_auth":"unknown","worst_case":"Page content may read data from another site, details unknown","analyst_note":"Check the Mozilla security advisory for this CVE to learn the exact impact, trigger conditions and whether it is exploited.","how_to_check":"- Check the Firefox version with Help > About Firefox or `firefox --version`; the fix is in Firefox 159 and Firefox ESR 153.6.\n- Check the ESR line in use if the browser is managed by an enterprise policy.","needs_analyst":true,"not_affected_if":["firefox-159-or-later","firefox-esr-153.6-or-later"],"who_is_affected":"Anyone running Firefox or Firefox ESR builds older than the fixed versions, including managed desktops that pin an ESR release. Server teams running Firefox only in CI or headless tests have little exposure beyond the browser itself. The sources do not say whether specific configurations or extensions are needed to trigger it.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.00061,"input_tokens":3252,"output_tokens":570,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-117928':14A,17A '-2026':13A,16A '153.6':90C '159':86C 'anoth':47B 'attack':58B 'break':35B 'bypass':7A,72C 'compon':79C 'comput':31B,78C 'content':34B 'css':2A,32B,75C 'cve':12A,15A 'data':50B 'desktop':18B 'enterpris':20B 'enterprise-esr':19B 'esr':21B,89C 'firefox':1A,22B,28B,85C,88C 'fix':83C 'flaw':4A,25B 'keep':42B 'let':5A,33B 'one':43B 'origin':10A,39B,70C 'page':6A 'pars':3A,29B,76C 'polici':11A,40B,71C 'read':46B,60B 'reliabl':63B 'runtim':23B 'same-origin':8A,37B,68C 'say':55B 'site':44B,48B 'sourc':52B 'use':67B 'vulner':81C","nicknames":[],"mitigations":[],"who_affected":"Anyone running Firefox or Firefox ESR builds older than the fixed versions, including managed desktops that pin an ESR release. Server teams running Firefox only in CI or headless tests have little exposure beyond the browser itself. The sources do not say whether specific configurations or extensions are needed to trigger it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-27T14:16:48+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-117928","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117928","severity":null,"published_at":"2026-10-27T14:16:48+00:00","modified_at":"2026-10-27T14:16:48+00:00","first_seen_at":"2026-10-27T14:32:23+00:00","fetched_at":"2026-10-27T14:32:23+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}