{"id":"CVE-2026-117976","kind":"vulnerability","aliases":["CVE-2026-117976"],"related":[],"title":"Firefox: DOM navigation flaw breaks site isolation, fixed in 159","description":"Site isolation issue in the DOM: Navigation component. This vulnerability was fixed in Firefox 159 and Firefox ESR 153.6.","summary":"A site isolation issue in the DOM Navigation component of Firefox was fixed in Firefox 159 and Firefox ESR 153.6. The sources do not say what an attacker can read or run through it.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["desktop-browsers","firefox","other"],"not_affected_if":["firefox-159-or-later","firefox-esr-153.6-or-later"],"how_to_check":"- Check the installed Firefox version, for example by opening Help > About Firefox or running `firefox --version`, and compare it with `159` and `153.6`.","fix":"- Update Firefox to `159` or later, or Firefox ESR to `153.6` or later.","status":"open","published_at":"2026-10-27T14:16:55+00:00","first_seen_at":"2026-10-27T14:32:24+00:00","triaged_at":"2026-10-27T14:35:14+00:00","updated_at":"2026-10-27T14:35:14+00:00","category":"other","confidence":0.4,"triage":{"at":"2026-10-27T14:35:14Z","model":"claude-haiku-5-5","output":{"fix":"- Update Firefox to `159` or later, or Firefox ESR to `153.6` or later.","reach":"internet","title":"Firefox: DOM navigation flaw breaks site isolation, fixed in 159","impact":"medium","summary":"A site isolation issue in the DOM Navigation component of Firefox was fixed in Firefox 159 and Firefox ESR 153.6. The sources do not say what an attacker can read or run through it.","category":"other","nicknames":[],"who_cares":["firefox","desktop-browsers"],"confidence":0.4,"needs_auth":"unknown","worst_case":"unknown; site isolation bypass, details not given by sources","analyst_note":"Check the Mozilla security advisory for this CVE to learn what site isolation boundary is crossed and whether user interaction is needed.","how_to_check":"- Check the installed Firefox version, for example by opening Help > About Firefox or running `firefox --version`, and compare it with `159` and `153.6`.","needs_analyst":true,"not_affected_if":["firefox-159-or-later","firefox-esr-153.6-or-later"],"who_is_affected":"Teams whose staff or systems run Firefox builds older than 159 or ESR older than 153.6 are likely exposed. The sources do not say which configurations or content are needed to trigger it, so unknown whether managed or kiosk setups differ.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000581,"input_tokens":3240,"output_tokens":514,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-117976':13A,16A '-2026':12A,15A '153.6':40B,71C '159':10A,36B,67C 'attack':48B 'break':5A 'browser':19B 'compon':29B,60C 'cve':11A,14A 'desktop':18B 'desktop-brows':17B 'dom':2A,27B,58C 'esr':39B,70C 'firefox':1A,20B,31B,35B,38B,66C,69C 'fix':8A,33B,64C 'flaw':4A 'isol':7A,23B,54C 'issu':24B,55C 'navig':3A,28B,59C 'read':50B 'run':52B 'say':45B 'site':6A,22B,53C 'sourc':42B 'vulner':62C","nicknames":[],"mitigations":[],"who_affected":"Teams whose staff or systems run Firefox builds older than 159 or ESR older than 153.6 are likely exposed. The sources do not say which configurations or content are needed to trigger it, so unknown whether managed or kiosk setups differ.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-27T14:16:55+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-117976","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117976","severity":null,"published_at":"2026-10-27T14:16:55+00:00","modified_at":"2026-10-27T14:16:55+00:00","first_seen_at":"2026-10-27T14:32:24+00:00","fetched_at":"2026-10-27T14:32:24+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}