---
id: "CVE-2026-117970"
kind: "vulnerability"
aliases: ["CVE-2026-117970"]
title: "Firefox: race condition in Disability Access APIs component fixed"
severity: "unknown"
cvss: null
epss: null
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["desktop-browsers", "firefox", "runtime"]
not_affected_if: ["already-on-fixed-version"]
published_at: "2026-10-27T14:16:54+00:00"
first_seen_at: "2026-10-27T14:32:24+00:00"
updated_at: "2026-10-27T14:35:18+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-117970", "first_seen_at": "2026-10-27T14:32:24+00:00"}]
---

# Firefox: race condition in Disability Access APIs component fixed

A race condition in the Disability Access APIs component of Firefox was fixed in Firefox 159 and Firefox ESR 153.6. The sources do not say what an attacker gains from triggering it.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Firefox version in the browser's About Firefox page or with `firefox --version`
- Compare against the fixed versions `159` and `153.6` for ESR builds

## Fix

- Update Firefox to `159` or later
- Update Firefox ESR to `153.6` or later

## Timeline

- 2026-10-27T14:32:24+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-117970

## From the sources

Race condition in the Disability Access APIs component. This vulnerability was fixed in Firefox 159 and Firefox ESR 153.6.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_