{"id":"CVE-2026-117975","kind":"vulnerability","aliases":["CVE-2026-117975"],"related":[],"title":"Firefox: invalid pointer in WebRender lets content escape the sandbox","description":"Sandbox escape due to invalid pointer in the Graphics: WebRender component. This vulnerability was fixed in Firefox 159 and Firefox ESR 153.6.","summary":"A flaw in the WebRender graphics component of Firefox uses an invalid pointer, which allows a sandbox escape. The sources say it was fixed in Firefox 159 and Firefox ESR 153.6.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["browser","desktop","firefox","runtime"],"not_affected_if":["already-updated"],"how_to_check":"- Run `firefox --version` or check Help > About Firefox and compare with `159` or `153.6`\n- unknown","fix":"- Update Firefox to `159` or later\n- Update Firefox ESR to `153.6` or later","status":"open","published_at":"2026-10-27T14:16:55+00:00","first_seen_at":"2026-10-27T14:32:24+00:00","triaged_at":"2026-10-27T14:35:14+00:00","updated_at":"2026-10-27T14:35:14+00:00","category":"runtime","confidence":0.5,"triage":{"at":"2026-10-27T14:35:14Z","model":"claude-haiku-5-5","output":{"fix":"- Update Firefox to `159` or later\n- Update Firefox ESR to `153.6` or later","reach":"internet","title":"Firefox: invalid pointer in WebRender lets content escape the sandbox","impact":"high","summary":"A flaw in the WebRender graphics component of Firefox uses an invalid pointer, which allows a sandbox escape. The sources say it was fixed in Firefox 159 and Firefox ESR 153.6.","category":"runtime","nicknames":[],"who_cares":["firefox","desktop","browser"],"confidence":0.5,"needs_auth":"unknown","worst_case":"Attacker escapes browser sandbox and reaches the host system","analyst_note":"Check the Mozilla security advisory for this CVE for exploit prerequisites, affected platforms and whether user interaction is required; the NVD entry alone gives no detail.","how_to_check":"- Run `firefox --version` or check Help > About Firefox and compare with `159` or `153.6`\n- unknown","needs_analyst":true,"not_affected_if":["already-updated"],"who_is_affected":"Anyone running Firefox or Firefox ESR builds older than the fixed versions, on desktop or in managed deployments. The sources do not say which platforms or configurations are most exposed, so unknown whether a default install is affected beyond the version check.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000576,"input_tokens":3258,"output_tokens":501,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-117975':13A,16A '-2026':12A,15A '153.6':51B,73C '159':47B,69C 'allow':35B 'browser':17B 'compon':27B,62C 'content':7A 'cve':11A,14A 'desktop':18B 'due':54C 'escap':8A,38B,53C 'esr':50B,72C 'firefox':1A,19B,29B,46B,49B,68C,71C 'fix':44B,66C 'flaw':22B 'graphic':26B,60C 'invalid':2A,32B,56C 'let':6A 'pointer':3A,33B,57C 'runtim':20B 'sandbox':10A,37B,52C 'say':41B 'sourc':40B 'use':30B 'vulner':64C 'webrend':5A,25B,61C","nicknames":[],"mitigations":[],"who_affected":"Anyone running Firefox or Firefox ESR builds older than the fixed versions, on desktop or in managed deployments. The sources do not say which platforms or configurations are most exposed, so unknown whether a default install is affected beyond the version check.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-27T14:16:55+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-117975","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117975","severity":null,"published_at":"2026-10-27T14:16:55+00:00","modified_at":"2026-10-27T14:16:55+00:00","first_seen_at":"2026-10-27T14:32:24+00:00","fetched_at":"2026-10-27T14:32:24+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}