{"id":"CVE-2026-117959","kind":"vulnerability","aliases":["CVE-2026-117959"],"related":[],"title":"Firefox: Service Workers site isolation flaw fixed in version 159","description":"Site isolation issue in the DOM: Service Workers component. This vulnerability was fixed in Firefox 159 and Firefox ESR 153.6.","summary":"A site isolation weakness in the Service Workers component of Firefox's DOM was fixed in Firefox 159 and Firefox ESR 153.6. The sources do not describe what an attacker can read or run through it.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["browsers","desktop","firefox","runtime"],"not_affected_if":["firefox-159-or-later","firefox-esr-153.6-or-later"],"how_to_check":"- Check the installed Firefox version in the browser's About page or with `firefox --version`\n- Check Firefox ESR installs against `153.6`","fix":"- Update Firefox to `159` or later\n- Update Firefox ESR to `153.6` or later","status":"open","published_at":"2026-10-27T14:16:51+00:00","first_seen_at":"2026-10-27T14:32:24+00:00","triaged_at":"2026-10-27T14:35:29+00:00","updated_at":"2026-10-27T14:35:29+00:00","category":"runtime","confidence":0.35,"triage":{"at":"2026-10-27T14:35:29Z","model":"claude-haiku-5-5","output":{"fix":"- Update Firefox to `159` or later\n- Update Firefox ESR to `153.6` or later","reach":"internet","title":"Firefox: Service Workers site isolation flaw fixed in version 159","impact":"medium","summary":"A site isolation weakness in the Service Workers component of Firefox's DOM was fixed in Firefox 159 and Firefox ESR 153.6. The sources do not describe what an attacker can read or run through it.","category":"runtime","nicknames":[],"who_cares":["firefox","browsers","desktop"],"confidence":0.35,"needs_auth":"unknown","worst_case":"unknown; sources do not say what data a page could reach","analyst_note":"Read the Mozilla security advisory for the Firefox 159 release to learn what a site could read across origins and whether user interaction is needed.","how_to_check":"- Check the installed Firefox version in the browser's About page or with `firefox --version`\n- Check Firefox ESR installs against `153.6`","needs_analyst":true,"not_affected_if":["firefox-159-or-later","firefox-esr-153.6-or-later"],"who_is_affected":"Anyone running a Firefox release older than 159 or a Firefox ESR build older than 153.6. The sources do not say whether any server-side or managed deployment is exposed beyond the browser itself.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000574,"input_tokens":3242,"output_tokens":499,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-117959':13A,16A '-2026':12A,15A '153.6':42B,74C '159':10A,38B,70C 'attack':50B 'browser':17B 'compon':29B,63C 'cve':11A,14A 'describ':47B 'desktop':18B 'dom':33B,60C 'esr':41B,73C 'firefox':1A,19B,31B,37B,40B,69C,72C 'fix':7A,35B,67C 'flaw':6A 'isol':5A,23B,56C 'issu':57C 'read':52B 'run':54B 'runtim':20B 'servic':2A,27B,61C 'site':4A,22B,55C 'sourc':44B 'version':9A 'vulner':65C 'weak':24B 'worker':3A,28B,62C","nicknames":[],"mitigations":[],"who_affected":"Anyone running a Firefox release older than 159 or a Firefox ESR build older than 153.6. The sources do not say whether any server-side or managed deployment is exposed beyond the browser itself.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-27T14:16:51+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-117959","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117959","severity":null,"published_at":"2026-10-27T14:16:51+00:00","modified_at":"2026-10-27T14:16:51+00:00","first_seen_at":"2026-10-27T14:32:24+00:00","fetched_at":"2026-10-27T14:32:24+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}