{"id":"CVE-2026-117992","kind":"vulnerability","aliases":["CVE-2026-117992"],"related":[],"title":"Firefox: CSS parsing flaw leaks information, fixed in Firefox 159","description":"Information disclosure in the CSS Parsing and Computation component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, and Firefox ESR 153.6.","summary":"A flaw in Firefox's CSS parsing and computation component can disclose information. The sources do not say what data is exposed or how an attacker triggers it.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["desktop-browsers","firefox","other"],"not_affected_if":["up-to-date-firefox"],"how_to_check":"- Check the installed Firefox version (Help > About Firefox, or `firefox --version`) against the fixed releases.\n- Check ESR installs against `115.44` and `153.6`.","fix":"- Update Firefox to `159` or later.\n- Update Firefox ESR to `115.44` or `153.6`, whichever matches the branch in use.","status":"open","published_at":"2026-10-27T14:16:57+00:00","first_seen_at":"2026-10-27T14:32:24+00:00","triaged_at":"2026-10-27T14:34:59+00:00","updated_at":"2026-10-27T14:34:59+00:00","category":"other","confidence":0.4,"triage":{"at":"2026-10-27T14:34:59Z","model":"claude-haiku-5-5","output":{"fix":"- Update Firefox to `159` or later.\n- Update Firefox ESR to `115.44` or `153.6`, whichever matches the branch in use.","reach":"unknown","title":"Firefox: CSS parsing flaw leaks information, fixed in Firefox 159","impact":"low","summary":"A flaw in Firefox's CSS parsing and computation component can disclose information. The sources do not say what data is exposed or how an attacker triggers it.","category":"other","nicknames":[],"who_cares":["firefox","desktop-browsers"],"confidence":0.4,"needs_auth":"unknown","worst_case":"unknown information exposed to a page or attacker; exact data not stated","analyst_note":"Find the Mozilla security advisory for this CVE to learn what information leaks and whether a user must visit a page.","how_to_check":"- Check the installed Firefox version (Help > About Firefox, or `firefox --version`) against the fixed releases.\n- Check ESR installs against `115.44` and `153.6`.","needs_analyst":true,"not_affected_if":["up-to-date-firefox"],"who_is_affected":"Anyone running a Firefox build older than the fixed releases, on desktop or ESR. Sources do not say which page content or configuration makes the flaw reachable, so exposure beyond the version check is unknown.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000575,"input_tokens":3256,"output_tokens":498,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-117992':13A,16A '-2026':12A,15A '115.44':66C '153.6':70C '159':10A,63C 'attack':46B 'browser':19B 'compon':30B,56C 'comput':29B,55C 'css':2A,26B,52C 'cve':11A,14A 'data':40B 'desktop':18B 'desktop-brows':17B 'disclos':32B 'disclosur':49C 'esr':65C,69C 'expos':42B 'firefox':1A,9A,20B,24B,62C,64C,68C 'fix':7A,60C 'flaw':4A,22B 'inform':6A,33B,48C 'leak':5A 'pars':3A,27B,53C 'say':38B 'sourc':35B 'trigger':47B 'vulner':58C","nicknames":[],"mitigations":[],"who_affected":"Anyone running a Firefox build older than the fixed releases, on desktop or ESR. Sources do not say which page content or configuration makes the flaw reachable, so exposure beyond the version check is unknown.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-27T14:16:57+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-117992","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117992","severity":null,"published_at":"2026-10-27T14:16:57+00:00","modified_at":"2026-10-27T14:16:57+00:00","first_seen_at":"2026-10-27T14:32:24+00:00","fetched_at":"2026-10-27T14:32:24+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}