{"id":"CVE-2026-117999","kind":"vulnerability","aliases":["CVE-2026-117999"],"related":[],"title":"Firefox: race condition in IPC component may allow unspecified exploitation","description":"Race condition in the IPC component. This vulnerability was fixed in Firefox 159 and Firefox ESR 153.6.","summary":"A race condition in Firefox's inter-process communication (IPC) component was fixed in Firefox 159 and Firefox ESR 153.6. The sources do not state what an attacker gains from it.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["browsers","desktop","firefox","runtime"],"not_affected_if":["firefox-159-or-later","firefox-esr-153.6-or-later"],"how_to_check":"- Check the Firefox version with `about:support` or the Help menu; unknown whether earlier versions are exposed beyond what is listed here.","fix":"- Update Firefox to `159` or later.\n- Update Firefox ESR to `153.6` or later.","status":"open","published_at":"2026-10-27T14:16:57+00:00","first_seen_at":"2026-10-27T14:32:25+00:00","triaged_at":"2026-10-27T14:34:51+00:00","updated_at":"2026-10-27T14:34:51+00:00","category":"runtime","confidence":0.3,"triage":{"at":"2026-10-27T14:34:51Z","model":"claude-haiku-5-5","output":{"fix":"- Update Firefox to `159` or later.\n- Update Firefox ESR to `153.6` or later.","reach":"unknown","title":"Firefox: race condition in IPC component may allow unspecified exploitation","impact":"medium","summary":"A race condition in Firefox's inter-process communication (IPC) component was fixed in Firefox 159 and Firefox ESR 153.6. The sources do not state what an attacker gains from it.","category":"runtime","nicknames":[],"who_cares":["firefox","desktop","browsers"],"confidence":0.3,"needs_auth":"unknown","worst_case":"unknown; sources do not state the impact","analyst_note":"Check Mozilla's Firefox 159 and ESR 153.6 release notes and the linked Mozilla security advisory for the impact and trigger conditions.","how_to_check":"- Check the Firefox version with `about:support` or the Help menu; unknown whether earlier versions are exposed beyond what is listed here.","needs_analyst":true,"not_affected_if":["firefox-159-or-later","firefox-esr-153.6-or-later"],"who_is_affected":"Teams that run Firefox or Firefox ESR on managed desktops or servers below the fixed versions. The sources do not say which configurations or inputs trigger the race, so unknown whether any setting removes exposure.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000574,"input_tokens":3224,"output_tokens":503,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-117999':13A,16A '-2026':12A,15A '153.6':41B,67C '159':37B,63C 'allow':8A 'attack':49B 'browser':17B 'communic':30B 'compon':6A,32B,56C 'condit':3A,23B,52C 'cve':11A,14A 'desktop':18B 'esr':40B,66C 'exploit':10A 'firefox':1A,19B,25B,36B,39B,62C,65C 'fix':34B,60C 'gain':50B 'inter':28B 'inter-process':27B 'ipc':5A,31B,55C 'may':7A 'process':29B 'race':2A,22B,51C 'runtim':20B 'sourc':43B 'state':46B 'unspecifi':9A 'vulner':58C","nicknames":[],"mitigations":[],"who_affected":"Teams that run Firefox or Firefox ESR on managed desktops or servers below the fixed versions. The sources do not say which configurations or inputs trigger the race, so unknown whether any setting removes exposure.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-27T14:16:57+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-117999","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117999","severity":null,"published_at":"2026-10-27T14:16:57+00:00","modified_at":"2026-10-27T14:16:57+00:00","first_seen_at":"2026-10-27T14:32:25+00:00","fetched_at":"2026-10-27T14:32:25+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}