Live › vulnerability › CVE-2026-117958
Go to dashboardA site isolation weakness in the Networking HTTP component of Firefox let one website interact with data from another site it should not reach. The sources do not say what data an attacker could read or how the flaw is triggered, and the description only states the fixed releases.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-27 14:32 UTC. All times on this page are UTC.
Teams that ship or depend on Firefox on developer machines or managed desktops are affected until they update to the fixed releases. The sources do not say which configurations or browsing conditions are needed to trigger it. Systems that do not run Firefox can skip it.
No product ranges from the sources yet.
firefox --version, and compare it with the fixed releases.153.6 or later.159 or later.153.6 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Site isolation issue in the Networking: HTTP component. This vulnerability was fixed in Firefox 159 and Firefox ESR 153.6.
This page as .md · .json · in your agent: get_signal("CVE-2026-117958")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.