---
id: "CVE-2026-117950"
kind: "vulnerability"
aliases: ["CVE-2026-117950"]
title: "Firefox: DOM boundary-condition flaw fixed in Firefox 159 and ESR"
severity: "unknown"
cvss: null
epss: null
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["browsers", "desktop-fleet", "firefox", "runtime"]
not_affected_if: ["already-on-fixed-version"]
published_at: "2026-10-27T14:16:50+00:00"
first_seen_at: "2026-10-27T14:32:23+00:00"
updated_at: "2026-10-27T14:35:38+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-117950", "first_seen_at": "2026-10-27T14:32:23+00:00"}]
---

# Firefox: DOM boundary-condition flaw fixed in Firefox 159 and ESR

Firefox's DOM Core and HTML component has an incorrect boundary condition that the vendor fixed in Firefox 159, ESR 115.44 and ESR 153.6. The sources do not say what an attacker gains from triggering it.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Firefox version in the About Firefox dialog or with `firefox --version`.
- Compare it against the fixed releases `159`, `115.44` and `153.6` for ESR.

## Fix

- Update Firefox to `159` or later on the current channel.
- Update Firefox ESR to `115.44` or `153.6`, whichever matches the installed ESR branch.

## Timeline

- 2026-10-27T14:32:23+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-117950

## From the sources

Incorrect boundary conditions in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, and Firefox ESR 153.6.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_