{"id":"CVE-2026-117958","kind":"vulnerability","aliases":["CVE-2026-117958"],"related":[],"title":"Firefox: site isolation flaw in HTTP networking fixed in 159","description":"Site isolation issue in the Networking: HTTP component. This vulnerability was fixed in Firefox 159 and Firefox ESR 153.6.","summary":"A site isolation weakness in the Networking HTTP component of Firefox let one website interact with data from another site it should not reach. The sources do not say what data an attacker could read or how the flaw is triggered, and the description only states the fixed releases.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["browser","desktop","firefox","other"],"not_affected_if":["not-running-firefox"],"how_to_check":"- Check the installed Firefox version in the About Firefox dialog or with `firefox --version`, and compare it with the fixed releases.\n- Check whether ESR installs are on `153.6` or later.","fix":"- Update Firefox to `159` or later.\n- Update Firefox ESR to `153.6` or later.","status":"open","published_at":"2026-10-27T14:16:51+00:00","first_seen_at":"2026-10-27T14:32:23+00:00","triaged_at":"2026-10-27T14:35:31+00:00","updated_at":"2026-10-27T14:35:31+00:00","category":"other","confidence":0.4,"triage":{"at":"2026-10-27T14:35:31Z","model":"claude-haiku-5-5","output":{"fix":"- Update Firefox to `159` or later.\n- Update Firefox ESR to `153.6` or later.","reach":"unknown","title":"Firefox: site isolation flaw in HTTP networking fixed in 159","impact":"medium","summary":"A site isolation weakness in the Networking HTTP component of Firefox let one website interact with data from another site it should not reach. The sources do not say what data an attacker could read or how the flaw is triggered, and the description only states the fixed releases.","category":"other","nicknames":[],"who_cares":["firefox","desktop","browser"],"confidence":0.4,"needs_auth":"unknown","worst_case":"unknown; sources do not say what cross-site data is exposed","analyst_note":"Check the Mozilla security advisory for this CVE for the exploit conditions and the data exposed by the site isolation flaw.","how_to_check":"- Check the installed Firefox version in the About Firefox dialog or with `firefox --version`, and compare it with the fixed releases.\n- Check whether ESR installs are on `153.6` or later.","needs_analyst":true,"not_affected_if":["not-running-firefox"],"who_is_affected":"Teams that ship or depend on Firefox on developer machines or managed desktops are affected until they update to the fixed releases. The sources do not say which configurations or browsing conditions are needed to trigger it. Systems that do not run Firefox can skip it.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000586,"input_tokens":3240,"output_tokens":525,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-117958':13A,16A '-2026':12A,15A '153.6':87C '159':10A,83C 'anoth':38B 'attack':52B 'browser':17B 'compon':28B,76C 'could':53B 'cve':11A,14A 'data':36B,50B 'descript':63B 'desktop':18B 'esr':86C 'firefox':1A,19B,30B,82C,85C 'fix':8A,67B,80C 'flaw':4A,58B 'http':6A,27B,75C 'interact':34B 'isol':3A,22B,70C 'issu':71C 'let':31B 'network':7A,26B,74C 'one':32B 'reach':43B 'read':54B 'releas':68B 'say':48B 'site':2A,21B,39B,69C 'sourc':45B 'state':65B 'trigger':60B 'vulner':78C 'weak':23B 'websit':33B","nicknames":[],"mitigations":[],"who_affected":"Teams that ship or depend on Firefox on developer machines or managed desktops are affected until they update to the fixed releases. The sources do not say which configurations or browsing conditions are needed to trigger it. Systems that do not run Firefox can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-27T14:16:51+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-117958","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117958","severity":null,"published_at":"2026-10-27T14:16:51+00:00","modified_at":"2026-10-27T14:16:51+00:00","first_seen_at":"2026-10-27T14:32:23+00:00","fetched_at":"2026-10-27T14:32:23+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}