{"id":"CVE-2026-117998","kind":"vulnerability","aliases":["CVE-2026-117998"],"related":[],"title":"Firefox: mitigation bypass in DOM Push Subscriptions component","description":"Mitigation bypass in the DOM: Push Subscriptions component. This vulnerability was fixed in Firefox 159 and Firefox ESR 153.6.","summary":"Firefox's DOM Push Subscriptions component had a flaw that let a mitigation be bypassed, according to the NVD description. The sources do not say what an attacker gains beyond that.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["browser","desktop","firefox","runtime"],"not_affected_if":["firefox-159-or-later","firefox-esr-153.6-or-later"],"how_to_check":"- Run `firefox --version` or check About Firefox and compare against the fixed releases.\n- unknown","fix":"- Update Firefox to `159` or Firefox ESR to `153.6`.","status":"open","published_at":"2026-10-27T14:16:57+00:00","first_seen_at":"2026-10-27T14:32:25+00:00","triaged_at":"2026-10-27T14:34:51+00:00","updated_at":"2026-10-27T14:34:51+00:00","category":"runtime","confidence":0.35,"triage":{"at":"2026-10-27T14:34:51Z","model":"claude-haiku-5-5","output":{"fix":"- Update Firefox to `159` or Firefox ESR to `153.6`.","reach":"unknown","title":"Firefox: mitigation bypass in DOM Push Subscriptions component","impact":"medium","summary":"Firefox's DOM Push Subscriptions component had a flaw that let a mitigation be bypassed, according to the NVD description. The sources do not say what an attacker gains beyond that.","category":"runtime","nicknames":[],"who_cares":["firefox","browser","desktop"],"confidence":0.35,"needs_auth":"unknown","worst_case":"unknown; the sources only say a mitigation can be bypassed","analyst_note":"Check Mozilla's Firefox 159 release notes and the Mozilla security advisory for this CVE to learn the attack scenario and impact.","how_to_check":"- Run `firefox --version` or check About Firefox and compare against the fixed releases.\n- unknown","needs_analyst":true,"not_affected_if":["firefox-159-or-later","firefox-esr-153.6-or-later"],"who_is_affected":"Anyone running Firefox builds older than 159 or Firefox ESR builds older than 153.6. The sources do not describe any extra configuration or role that changes exposure.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.00056,"input_tokens":3250,"output_tokens":470,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-117998':11A,14A '-2026':10A,13A '153.6':67C '159':63C 'accord':34B 'attack':46B 'beyond':48B 'browser':15B 'bypass':3A,33B,50C 'compon':8A,24B,56C 'cve':9A,12A 'descript':38B 'desktop':16B 'dom':5A,21B,53C 'esr':66C 'firefox':1A,17B,19B,62C,65C 'fix':60C 'flaw':27B 'gain':47B 'let':29B 'mitig':2A,31B,49C 'nvd':37B 'push':6A,22B,54C 'runtim':18B 'say':43B 'sourc':40B 'subscript':7A,23B,55C 'vulner':58C","nicknames":[],"mitigations":[],"who_affected":"Anyone running Firefox builds older than 159 or Firefox ESR builds older than 153.6. The sources do not describe any extra configuration or role that changes exposure.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-27T14:16:57+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-117998","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117998","severity":null,"published_at":"2026-10-27T14:16:57+00:00","modified_at":"2026-10-27T14:16:57+00:00","first_seen_at":"2026-10-27T14:32:25+00:00","fetched_at":"2026-10-27T14:32:25+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}