{"id":"CVE-2026-117933","kind":"vulnerability","aliases":["CVE-2026-117933"],"related":[],"title":"Firefox: CSS parsing flaw enables frame poisoning, fixed in 159","description":"Frame poisoning in the CSS Parsing and Computation component. This vulnerability was fixed in Firefox 159 and Firefox ESR 153.6.","summary":"A memory-safety style flaw in Firefox's CSS parsing and computation component allows frame poisoning, a corruption of browser internal state. The sources do not state what an attacker can achieve beyond that, and no severity was given.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["browsers","desktop","firefox","package"],"not_affected_if":["fixed-version"],"how_to_check":"- Run `firefox --version` or check Help, About Firefox, and compare against `159` or `153.6` for ESR.\n- unknown","fix":"- Update Firefox to `159` or Firefox ESR to `153.6` or later.","status":"open","published_at":"2026-10-27T14:16:48+00:00","first_seen_at":"2026-10-27T14:32:23+00:00","triaged_at":"2026-10-27T14:37:05+00:00","updated_at":"2026-10-27T14:37:05+00:00","category":"package","confidence":0.4,"triage":{"at":"2026-10-27T14:37:05Z","model":"claude-haiku-5-5","output":{"fix":"- Update Firefox to `159` or Firefox ESR to `153.6` or later.","reach":"unknown","title":"Firefox: CSS parsing flaw enables frame poisoning, fixed in 159","impact":"medium","summary":"A memory-safety style flaw in Firefox's CSS parsing and computation component allows frame poisoning, a corruption of browser internal state. The sources do not state what an attacker can achieve beyond that, and no severity was given.","category":"package","nicknames":[],"who_cares":["firefox","browsers","desktop"],"confidence":0.4,"needs_auth":"unknown","worst_case":"unknown","analyst_note":"Check the Mozilla security advisory for CVE-2026-117933 to learn the exact impact, trigger conditions and severity rating.","how_to_check":"- Run `firefox --version` or check Help, About Firefox, and compare against `159` or `153.6` for ESR.\n- unknown","needs_analyst":true,"not_affected_if":["fixed-version"],"who_is_affected":"Anyone running Firefox builds older than 159 or ESR builds older than 153.6. The sources do not say which configurations or content are needed to trigger it, so the exposure window beyond version is unknown.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000559,"input_tokens":3246,"output_tokens":469,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-117933':13A,16A '-2026':12A,15A '153.6':80C '159':10A,76C 'achiev':53B 'allow':35B 'attack':51B 'beyond':54B 'browser':17B,41B 'compon':34B,69C 'comput':33B,68C 'corrupt':39B 'css':2A,30B,65C 'cve':11A,14A 'desktop':18B 'enabl':5A 'esr':79C 'firefox':1A,19B,28B,75C,78C 'fix':8A,73C 'flaw':4A,26B 'frame':6A,36B,61C 'given':60B 'intern':42B 'memori':23B 'memory-safeti':22B 'packag':20B 'pars':3A,31B,66C 'poison':7A,37B,62C 'safeti':24B 'sever':58B 'sourc':45B 'state':43B,48B 'style':25B 'vulner':71C","nicknames":[],"mitigations":[],"who_affected":"Anyone running Firefox builds older than 159 or ESR builds older than 153.6. The sources do not say which configurations or content are needed to trigger it, so the exposure window beyond version is unknown.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-27T14:16:48+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-117933","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117933","severity":null,"published_at":"2026-10-27T14:16:48+00:00","modified_at":"2026-10-27T14:16:48+00:00","first_seen_at":"2026-10-27T14:32:23+00:00","fetched_at":"2026-10-27T14:32:23+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}