---
id: "CVE-2026-117981"
kind: "vulnerability"
aliases: ["CVE-2026-117981"]
title: "Firefox: Toolkit flaw lets attackers escalate privileges, fixed in 159"
severity: "unknown"
cvss: null
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["desktop", "firefox", "managed-fleet", "other"]
not_affected_if: []
published_at: "2026-10-27T14:16:56+00:00"
first_seen_at: "2026-10-27T14:32:24+00:00"
updated_at: "2026-10-27T14:35:07+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-117981", "first_seen_at": "2026-10-27T14:32:24+00:00"}]
---

# Firefox: Toolkit flaw lets attackers escalate privileges, fixed in 159

A flaw in the Firefox Toolkit component allows privilege escalation. Mozilla fixed it in Firefox 159 and Firefox ESR 153.6, and the sources do not say what an attacker gets beyond that.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Run `firefox --version` or open Help > About Firefox and compare against `159` or `153.6`
- unknown for anything beyond the version check, as the sources do not say what else to look at

## Fix

- Update Firefox to `159` or Firefox ESR to `153.6`
- unknown for any other action, as the sources do not say

## Timeline

- 2026-10-27T14:32:24+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-117981

## From the sources

Privilege escalation in the Toolkit component. This vulnerability was fixed in Firefox 159 and Firefox ESR 153.6.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_