{"id":"CVE-2026-118000","kind":"vulnerability","aliases":["CVE-2026-118000"],"related":[],"title":"Firefox: HTTP networking flaw can leak information to attackers","description":"Information disclosure in the Networking: HTTP component. This vulnerability was fixed in Firefox 159 and Firefox ESR 153.6.","summary":"A flaw in the HTTP networking component of Firefox can disclose information. The sources say it was fixed in Firefox 159 and Firefox ESR 153.6 but do not describe the exact data exposed.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["browsers","desktop","firefox","runtime"],"not_affected_if":["already-on-fixed-version"],"how_to_check":"- Check the installed Firefox version in the browser's About page or with `firefox --version`.\n- Check ESR installs against `153.6` or later.","fix":"- Upgrade Firefox to `159` or later.\n- Upgrade Firefox ESR to `153.6` or later.","status":"open","published_at":"2026-10-27T14:16:57+00:00","first_seen_at":"2026-10-27T14:32:25+00:00","triaged_at":"2026-10-27T14:34:51+00:00","updated_at":"2026-10-27T14:34:51+00:00","category":"runtime","confidence":0.4,"triage":{"at":"2026-10-27T14:34:51Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Firefox to `159` or later.\n- Upgrade Firefox ESR to `153.6` or later.","reach":"unknown","title":"Firefox: HTTP networking flaw can leak information to attackers","impact":"low","summary":"A flaw in the HTTP networking component of Firefox can disclose information. The sources say it was fixed in Firefox 159 and Firefox ESR 153.6 but do not describe the exact data exposed.","category":"runtime","nicknames":[],"who_cares":["firefox","desktop","browsers"],"confidence":0.4,"needs_auth":"unknown","worst_case":"Attacker reads some information the browser should keep private.","analyst_note":"Check the Mozilla security advisory for the Firefox 159 and ESR 153.6 release to learn what information is disclosed and what triggers it.","how_to_check":"- Check the installed Firefox version in the browser's About page or with `firefox --version`.\n- Check ESR installs against `153.6` or later.","needs_analyst":true,"not_affected_if":["already-on-fixed-version"],"who_is_affected":"Teams that ship or depend on Firefox builds older than 159 or ESR older than 153.6, including managed desktop fleets. The sources do not say which configurations or content are required to trigger the flaw, so the exact exposure is unknown.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000576,"input_tokens":3238,"output_tokens":505,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-118000':12A,15A '-2026':11A,14A '153.6':44B,70C '159':40B,66C 'attack':9A 'browser':16B 'compon':26B,59C 'cve':10A,13A 'data':51B 'describ':48B 'desktop':17B 'disclos':30B 'disclosur':54C 'esr':43B,69C 'exact':50B 'expos':52B 'firefox':1A,18B,28B,39B,42B,65C,68C 'fix':37B,63C 'flaw':4A,21B 'http':2A,24B,58C 'inform':7A,31B,53C 'leak':6A 'network':3A,25B,57C 'runtim':19B 'say':34B 'sourc':33B 'vulner':61C","nicknames":[],"mitigations":[],"who_affected":"Teams that ship or depend on Firefox builds older than 159 or ESR older than 153.6, including managed desktop fleets. The sources do not say which configurations or content are required to trigger the flaw, so the exact exposure is unknown.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-27T14:16:57+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-118000","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118000","severity":null,"published_at":"2026-10-27T14:16:57+00:00","modified_at":"2026-10-27T14:16:57+00:00","first_seen_at":"2026-10-27T14:32:25+00:00","fetched_at":"2026-10-27T14:32:25+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}