---
id: "CVE-2026-117995"
kind: "vulnerability"
aliases: ["CVE-2026-117995"]
title: "Firefox: DOM UI Events and Focus Handling flaw allows privilege escalation"
severity: "unknown"
cvss: null
epss: null
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["browser", "desktop", "firefox", "runtime"]
not_affected_if: ["fixed-version"]
published_at: "2026-10-27T14:16:57+00:00"
first_seen_at: "2026-10-27T14:32:25+00:00"
updated_at: "2026-10-27T14:34:55+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-117995", "first_seen_at": "2026-10-27T14:32:25+00:00"}]
---

# Firefox: DOM UI Events and Focus Handling flaw allows privilege escalation

A flaw in the DOM UI Events and Focus Handling component of Firefox lets code gain higher privileges than it should have. The sources do not say what the attacker must do to trigger it or what level of access is gained.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Run `firefox --version` (or check About Firefox) and compare against `159` for Firefox or `153.6` for Firefox ESR
- Check the installed ESR version with the same command on machines that use the ESR channel

## Fix

- Update Firefox to `159` or later
- Update Firefox ESR to `153.6` or later

## Timeline

- 2026-10-27T14:32:25+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-117995

## From the sources

Privilege escalation in the DOM: UI Events & Focus Handling component. This vulnerability was fixed in Firefox 159 and Firefox ESR 153.6.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_