Live › vulnerability › CVE-2026-117950
Go to dashboardFirefox's DOM Core and HTML component has an incorrect boundary condition that the vendor fixed in Firefox 159, ESR 115.44 and ESR 153.6. The sources do not say what an attacker gains from triggering it.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-27 14:32 UTC. All times on this page are UTC.
Any installed Firefox build older than the fixed versions is in scope, since the flaw is in the core DOM code every page uses. Teams that run only managed or pinned browser builds should confirm with their browser management tooling. The sources do not say whether specific page content or settings are needed to reach the flaw.
No product ranges from the sources yet.
firefox --version.159, 115.44 and 153.6 for ESR.159 or later on the current channel.115.44 or 153.6, whichever matches the installed ESR branch.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Incorrect boundary conditions in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, and Firefox ESR 153.6.
This page as .md · .json · in your agent: get_signal("CVE-2026-117950")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.