{"id":"CVE-2026-117970","kind":"vulnerability","aliases":["CVE-2026-117970"],"related":[],"title":"Firefox: race condition in Disability Access APIs component fixed","description":"Race condition in the Disability Access APIs component. This vulnerability was fixed in Firefox 159 and Firefox ESR 153.6.","summary":"A race condition in the Disability Access APIs component of Firefox was fixed in Firefox 159 and Firefox ESR 153.6. The sources do not say what an attacker gains from triggering it.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["desktop-browsers","firefox","runtime"],"not_affected_if":["already-on-fixed-version"],"how_to_check":"- Check the installed Firefox version in the browser's About Firefox page or with `firefox --version`\n- Compare against the fixed versions `159` and `153.6` for ESR builds","fix":"- Update Firefox to `159` or later\n- Update Firefox ESR to `153.6` or later","status":"open","published_at":"2026-10-27T14:16:54+00:00","first_seen_at":"2026-10-27T14:32:24+00:00","triaged_at":"2026-10-27T14:35:18+00:00","updated_at":"2026-10-27T14:35:18+00:00","category":"runtime","confidence":0.4,"triage":{"at":"2026-10-27T14:35:18Z","model":"claude-haiku-5-5","output":{"fix":"- Update Firefox to `159` or later\n- Update Firefox ESR to `153.6` or later","reach":"unknown","title":"Firefox: race condition in Disability Access APIs component fixed","impact":"medium","summary":"A race condition in the Disability Access APIs component of Firefox was fixed in Firefox 159 and Firefox ESR 153.6. The sources do not say what an attacker gains from triggering it.","category":"runtime","nicknames":[],"who_cares":["firefox","desktop-browsers"],"confidence":0.4,"needs_auth":"unknown","worst_case":"unknown","analyst_note":"Find the Mozilla advisory for this CVE to confirm the impact, the trigger and whether accessibility features must be enabled.","how_to_check":"- Check the installed Firefox version in the browser's About Firefox page or with `firefox --version`\n- Compare against the fixed versions `159` and `153.6` for ESR builds","needs_analyst":true,"not_affected_if":["already-on-fixed-version"],"who_is_affected":"Any installed Firefox build older than the fixed versions is affected, as the description names no special configuration. The sources do not say whether the flaw needs accessibility features enabled or any particular page or input to trigger. Teams that run Firefox ESR should use the ESR fixed version.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000572,"input_tokens":3234,"output_tokens":498,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-117970':12A,15A '-2026':11A,14A '153.6':40B,70C '159':36B,66C 'access':6A,27B,57C 'api':7A,28B,58C 'attack':48B 'browser':18B 'compon':8A,29B,59C 'condit':3A,23B,53C 'cve':10A,13A 'desktop':17B 'desktop-brows':16B 'disabl':5A,26B,56C 'esr':39B,69C 'firefox':1A,19B,31B,35B,38B,65C,68C 'fix':9A,33B,63C 'gain':49B 'race':2A,22B,52C 'runtim':20B 'say':45B 'sourc':42B 'trigger':51B 'vulner':61C","nicknames":[],"mitigations":[],"who_affected":"Any installed Firefox build older than the fixed versions is affected, as the description names no special configuration. The sources do not say whether the flaw needs accessibility features enabled or any particular page or input to trigger. Teams that run Firefox ESR should use the ESR fixed version.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-27T14:16:54+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-117970","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117970","severity":null,"published_at":"2026-10-27T14:16:54+00:00","modified_at":"2026-10-27T14:16:54+00:00","first_seen_at":"2026-10-27T14:32:24+00:00","fetched_at":"2026-10-27T14:32:24+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}