{"id":"CVE-2026-117995","kind":"vulnerability","aliases":["CVE-2026-117995"],"related":[],"title":"Firefox: DOM UI Events and Focus Handling flaw allows privilege escalation","description":"Privilege escalation in the DOM: UI Events & Focus Handling component. This vulnerability was fixed in Firefox 159 and Firefox ESR 153.6.","summary":"A flaw in the DOM UI Events and Focus Handling component of Firefox lets code gain higher privileges than it should have. The sources do not say what the attacker must do to trigger it or what level of access is gained.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["browser","desktop","firefox","runtime"],"not_affected_if":["fixed-version"],"how_to_check":"- Run `firefox --version` (or check About Firefox) and compare against `159` for Firefox or `153.6` for Firefox ESR\n- Check the installed ESR version with the same command on machines that use the ESR channel","fix":"- Update Firefox to `159` or later\n- Update Firefox ESR to `153.6` or later","status":"open","published_at":"2026-10-27T14:16:57+00:00","first_seen_at":"2026-10-27T14:32:25+00:00","triaged_at":"2026-10-27T14:34:55+00:00","updated_at":"2026-10-27T14:34:55+00:00","category":"runtime","confidence":0.4,"triage":{"at":"2026-10-27T14:34:55Z","model":"claude-haiku-5-5","output":{"fix":"- Update Firefox to `159` or later\n- Update Firefox ESR to `153.6` or later","reach":"unknown","title":"Firefox: DOM UI Events and Focus Handling flaw allows privilege escalation","impact":"medium","summary":"A flaw in the DOM UI Events and Focus Handling component of Firefox lets code gain higher privileges than it should have. The sources do not say what the attacker must do to trigger it or what level of access is gained.","category":"runtime","nicknames":[],"who_cares":["firefox","browser","desktop"],"confidence":0.4,"needs_auth":"unknown","worst_case":"unknown; sources only say privilege escalation","analyst_note":"Check the Mozilla security advisory for this CVE to confirm the attack vector, user interaction and what privilege is gained.","how_to_check":"- Run `firefox --version` (or check About Firefox) and compare against `159` for Firefox or `153.6` for Firefox ESR\n- Check the installed ESR version with the same command on machines that use the ESR channel","needs_analyst":true,"not_affected_if":["fixed-version"],"who_is_affected":"Anyone running Firefox or Firefox ESR builds older than 159 and 153.6 respectively. The sources do not say whether a specific configuration or user action is required, so exposure beyond the version check is unknown.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.00058,"input_tokens":3254,"output_tokens":509,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-117995':14A,17A '-2026':13A,16A '153.6':84C '159':80C 'access':61B 'allow':9A 'attack':51B 'browser':18B 'code':36B 'compon':32B,73C 'cve':12A,15A 'desktop':19B 'dom':2A,26B,68C 'escal':11A,65C 'esr':83C 'event':4A,28B,70C 'firefox':1A,20B,34B,79C,82C 'fix':77C 'flaw':8A,23B 'focus':6A,30B,71C 'gain':37B,63B 'handl':7A,31B,72C 'higher':38B 'let':35B 'level':59B 'must':52B 'privileg':10A,39B,64C 'runtim':21B 'say':48B 'sourc':45B 'trigger':55B 'ui':3A,27B,69C 'vulner':75C","nicknames":[],"mitigations":[],"who_affected":"Anyone running Firefox or Firefox ESR builds older than 159 and 153.6 respectively. The sources do not say whether a specific configuration or user action is required, so exposure beyond the version check is unknown.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-27T14:16:57+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-117995","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117995","severity":null,"published_at":"2026-10-27T14:16:57+00:00","modified_at":"2026-10-27T14:16:57+00:00","first_seen_at":"2026-10-27T14:32:25+00:00","fetched_at":"2026-10-27T14:32:25+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}