Live › vulnerability › CVE-2026-117965
Go to dashboardA flaw in the Firefox Address Bar component lets a page break the same-origin policy, which normally keeps one site from reading another site's data. The sources do not say what an attacker can read or how reliably it can be used.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-27 14:32 UTC. All times on this page are UTC.
Anyone running Firefox builds older than 159 or ESR builds older than 153.6 is likely exposed, since the sources say the fix shipped in those releases. The sources do not say which versions are first affected or whether the bug needs a particular setting or user action.
No product ranges from the sources yet.
firefox --version (or check About Firefox) and compare against 159 or 153.6 for ESR159 or Firefox ESR to 153.6Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Same-origin policy bypass in the Address Bar component. This vulnerability was fixed in Firefox 159 and Firefox ESR 153.6.
This page as .md · .json · in your agent: get_signal("CVE-2026-117965")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.