{"id":"CVE-2026-117965","kind":"vulnerability","aliases":["CVE-2026-117965"],"related":[],"title":"Firefox: Address Bar flaw bypasses same-origin policy, fixed in 159","description":"Same-origin policy bypass in the Address Bar component. This vulnerability was fixed in Firefox 159 and Firefox ESR 153.6.","summary":"A flaw in the Firefox Address Bar component lets a page break the same-origin policy, which normally keeps one site from reading another site's data. The sources do not say what an attacker can read or how reliably it can be used.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["browsers","desktop-users","firefox","other"],"not_affected_if":["already-on-firefox-159-or-esr-153.6"],"how_to_check":"- Run `firefox --version` (or check About Firefox) and compare against `159` or `153.6` for ESR\n- unknown","fix":"- Update Firefox to `159` or Firefox ESR to `153.6`\n- unknown","status":"open","published_at":"2026-10-27T14:16:54+00:00","first_seen_at":"2026-10-27T14:32:24+00:00","triaged_at":"2026-10-27T14:35:22+00:00","updated_at":"2026-10-27T14:35:22+00:00","category":"other","confidence":0.4,"triage":{"at":"2026-10-27T14:35:22Z","model":"claude-haiku-5-5","output":{"fix":"- Update Firefox to `159` or Firefox ESR to `153.6`\n- unknown","reach":"internet","title":"Firefox: Address Bar flaw bypasses same-origin policy, fixed in 159","impact":"medium","summary":"A flaw in the Firefox Address Bar component lets a page break the same-origin policy, which normally keeps one site from reading another site's data. The sources do not say what an attacker can read or how reliably it can be used.","category":"other","nicknames":[],"who_cares":["firefox","browsers","desktop-users"],"confidence":0.4,"needs_auth":"unknown","worst_case":"unknown; the sources do not describe what data is exposed","analyst_note":"Check the Mozilla security advisory for this CVE to learn the affected version range, the attack conditions and the severity rating.","how_to_check":"- Run `firefox --version` (or check About Firefox) and compare against `159` or `153.6` for ESR\n- unknown","needs_analyst":true,"not_affected_if":["already-on-firefox-159-or-esr-153.6"],"who_is_affected":"Anyone running Firefox builds older than 159 or ESR builds older than 153.6 is likely exposed, since the sources say the fix shipped in those releases. The sources do not say which versions are first affected or whether the bug needs a particular setting or user action.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000576,"input_tokens":3240,"output_tokens":505,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-117965':15A,18A '-2026':14A,17A '153.6':89C '159':12A,85C 'address':2A,29B,76C 'anoth':48B 'attack':59B 'bar':3A,30B,77C 'break':35B 'browser':19B 'bypass':5A,73C 'compon':31B,78C 'cve':13A,16A 'data':51B 'desktop':21B 'desktop-us':20B 'esr':88C 'firefox':1A,23B,28B,84C,87C 'fix':10A,82C 'flaw':4A,25B 'keep':43B 'let':32B 'normal':42B 'one':44B 'origin':8A,39B,71C 'page':34B 'polici':9A,40B,72C 'read':47B,61B 'reliabl':64B 'same-origin':6A,37B,69C 'say':56B 'site':45B,49B 'sourc':53B 'use':68B 'user':22B 'vulner':80C","nicknames":[],"mitigations":[],"who_affected":"Anyone running Firefox builds older than 159 or ESR builds older than 153.6 is likely exposed, since the sources say the fix shipped in those releases. The sources do not say which versions are first affected or whether the bug needs a particular setting or user action.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-27T14:16:54+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-117965","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117965","severity":null,"published_at":"2026-10-27T14:16:54+00:00","modified_at":"2026-10-27T14:16:54+00:00","first_seen_at":"2026-10-27T14:32:24+00:00","fetched_at":"2026-10-27T14:32:24+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}