{"id":"CVE-2026-117984","kind":"vulnerability","aliases":["CVE-2026-117984"],"related":[],"title":"Firefox: incorrect boundary handling in scrolling and overflow layout","description":"Incorrect boundary conditions in the Layout: Scrolling and Overflow component. This vulnerability was fixed in Firefox 159 and Firefox ESR 153.6.","summary":"Mozilla Firefox has a flaw in how its Layout Scrolling and Overflow component handles boundary conditions. The sources do not say what an attacker gets from it beyond the general memory-safety-style class of bug.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["browser","desktop","firefox","runtime"],"not_affected_if":["already-updated-browser"],"how_to_check":"- Run `firefox --version` (or check About Firefox) and compare with `159` or `153.6` for ESR.","fix":"- Update Firefox to `159` or later, or Firefox ESR to `153.6` or later.","status":"open","published_at":"2026-10-27T14:16:56+00:00","first_seen_at":"2026-10-27T14:32:24+00:00","triaged_at":"2026-10-27T14:35:06+00:00","updated_at":"2026-10-27T14:35:06+00:00","category":"runtime","confidence":0.4,"triage":{"at":"2026-10-27T14:35:06Z","model":"claude-haiku-5-5","output":{"fix":"- Update Firefox to `159` or later, or Firefox ESR to `153.6` or later.","reach":"unknown","title":"Firefox: incorrect boundary handling in scrolling and overflow layout","impact":"medium","summary":"Mozilla Firefox has a flaw in how its Layout Scrolling and Overflow component handles boundary conditions. The sources do not say what an attacker gets from it beyond the general memory-safety-style class of bug.","category":"runtime","nicknames":[],"who_cares":["firefox","browser","desktop"],"confidence":0.4,"needs_auth":"unknown","worst_case":"unknown; attacker impact not stated by the sources","analyst_note":"Check the Mozilla advisory for this CVE to confirm the impact, trigger and whether it is web-reachable: https://nvd.nist.gov/vuln/detail/CVE-2026-117984","how_to_check":"- Run `firefox --version` (or check About Firefox) and compare with `159` or `153.6` for ESR.","needs_analyst":true,"not_affected_if":["already-updated-browser"],"who_is_affected":"Anyone running a Firefox build older than 159 or Firefox ESR older than 153.6. The sources do not describe the exact trigger, so whether web content alone is enough is unknown.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000572,"input_tokens":3260,"output_tokens":493,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-117984':12A,15A '-2026':11A,14A '153.6':77C '159':73C 'attack':43B 'beyond':47B 'boundari':3A,34B,58C 'browser':16B 'bug':56B 'class':54B 'compon':32B,66C 'condit':35B,59C 'cve':10A,13A 'desktop':17B 'esr':76C 'firefox':1A,18B,21B,72C,75C 'fix':70C 'flaw':24B 'general':49B 'get':44B 'handl':4A,33B 'incorrect':2A,57C 'layout':9A,28B,62C 'memori':51B 'memory-safety-styl':50B 'mozilla':20B 'overflow':8A,31B,65C 'runtim':19B 'safeti':52B 'say':40B 'scroll':6A,29B,63C 'sourc':37B 'style':53B 'vulner':68C","nicknames":[],"mitigations":[],"who_affected":"Anyone running a Firefox build older than 159 or Firefox ESR older than 153.6. The sources do not describe the exact trigger, so whether web content alone is enough is unknown.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-27T14:16:56+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-117984","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117984","severity":null,"published_at":"2026-10-27T14:16:56+00:00","modified_at":"2026-10-27T14:16:56+00:00","first_seen_at":"2026-10-27T14:32:24+00:00","fetched_at":"2026-10-27T14:32:24+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}