{"id":"CVE-2026-117990","kind":"vulnerability","aliases":["CVE-2026-117990"],"related":[],"title":"Firefox WebRender: boundary check flaw allows sandbox escape","description":"Sandbox escape due to incorrect boundary conditions in the Graphics: WebRender component. This vulnerability was fixed in Firefox 159 and Firefox ESR 153.6.","summary":"Firefox's WebRender graphics component has incorrect boundary conditions that let a crafted page escape the browser sandbox. The fix shipped in Firefox 159 and Firefox ESR 153.6.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["browsers","desktop","firefox","firefox-esr","other"],"not_affected_if":["already-updated"],"how_to_check":"- Run `firefox --version` (or check About Firefox) and compare against `159` or ESR `153.6`\n- Check the managed fleet inventory for Firefox ESR builds older than `153.6`","fix":"- Update Firefox to `159` or later\n- Update Firefox ESR to `153.6` or later","status":"open","published_at":"2026-10-27T14:16:56+00:00","first_seen_at":"2026-10-27T14:32:24+00:00","triaged_at":"2026-10-27T14:34:59+00:00","updated_at":"2026-10-27T14:34:59+00:00","category":"other","confidence":0.5,"triage":{"at":"2026-10-27T14:34:59Z","model":"claude-haiku-5-5","output":{"fix":"- Update Firefox to `159` or later\n- Update Firefox ESR to `153.6` or later","reach":"internet","title":"Firefox WebRender: boundary check flaw allows sandbox escape","impact":"high","summary":"Firefox's WebRender graphics component has incorrect boundary conditions that let a crafted page escape the browser sandbox. The fix shipped in Firefox 159 and Firefox ESR 153.6.","category":"other","nicknames":[],"who_cares":["firefox","firefox-esr","desktop","browsers"],"confidence":0.5,"needs_auth":"no","worst_case":"A crafted web page can break out of the browser sandbox","analyst_note":"Sources give no CVSS, exploit details or affected version range; check Mozilla's Firefox 159 security advisory for the exact impacted versions and the exploitation requirements.","how_to_check":"- Run `firefox --version` (or check About Firefox) and compare against `159` or ESR `153.6`\n- Check the managed fleet inventory for Firefox ESR builds older than `153.6`","needs_analyst":true,"not_affected_if":["already-updated"],"who_is_affected":"Anyone running Firefox or Firefox ESR builds older than 159 or 153.6 is exposed, since the flaw sits in the browser's rendering path that handles web content. Teams that only use Firefox on managed machines with auto-update enabled are likely already patched, and servers without a browser can skip it.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.0006,"input_tokens":3266,"output_tokens":547,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-117990':11A,14A '-2026':10A,13A '153.6':48B,71C '159':44B,67C 'allow':6A 'boundari':3A,28B,54C 'browser':15B,37B 'check':4A 'compon':25B,60C 'condit':29B,55C 'craft':33B 'cve':9A,12A 'desktop':16B 'due':51C 'escap':8A,35B,50C 'esr':20B,47B,70C 'firefox':1A,17B,19B,21B,43B,46B,66C,69C 'firefox-esr':18B 'fix':40B,64C 'flaw':5A 'graphic':24B,58C 'incorrect':27B,53C 'let':31B 'page':34B 'sandbox':7A,38B,49C 'ship':41B 'vulner':62C 'webrend':2A,23B,59C","nicknames":[],"mitigations":[],"who_affected":"Anyone running Firefox or Firefox ESR builds older than 159 or 153.6 is exposed, since the flaw sits in the browser's rendering path that handles web content. Teams that only use Firefox on managed machines with auto-update enabled are likely already patched, and servers without a browser can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-27T14:16:56+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-117990","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117990","severity":null,"published_at":"2026-10-27T14:16:56+00:00","modified_at":"2026-10-27T14:16:56+00:00","first_seen_at":"2026-10-27T14:32:24+00:00","fetched_at":"2026-10-27T14:32:24+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}