---
id: "CVE-2026-118000"
kind: "vulnerability"
aliases: ["CVE-2026-118000"]
title: "Firefox: HTTP networking flaw can leak information to attackers"
severity: "unknown"
cvss: null
epss: null
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["browsers", "desktop", "firefox", "runtime"]
not_affected_if: ["already-on-fixed-version"]
published_at: "2026-10-27T14:16:57+00:00"
first_seen_at: "2026-10-27T14:32:25+00:00"
updated_at: "2026-10-27T14:34:51+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-118000", "first_seen_at": "2026-10-27T14:32:25+00:00"}]
---

# Firefox: HTTP networking flaw can leak information to attackers

A flaw in the HTTP networking component of Firefox can disclose information. The sources say it was fixed in Firefox 159 and Firefox ESR 153.6 but do not describe the exact data exposed.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Firefox version in the browser's About page or with `firefox --version`.
- Check ESR installs against `153.6` or later.

## Fix

- Upgrade Firefox to `159` or later.
- Upgrade Firefox ESR to `153.6` or later.

## Timeline

- 2026-10-27T14:32:25+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-118000

## From the sources

Information disclosure in the Networking: HTTP component. This vulnerability was fixed in Firefox 159 and Firefox ESR 153.6.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_