{"id":"CVE-2026-118002","kind":"vulnerability","aliases":["CVE-2026-118002"],"related":[],"title":"Firefox: race condition in Networking component leaks information","description":"Information disclosure due to race condition in the Networking component. This vulnerability was fixed in Firefox 159 and Firefox ESR 153.6.","summary":"A race condition in the Firefox Networking component can expose information to an attacker. The fix is in Firefox 159 and Firefox ESR 153.6.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["desktop-browsers","firefox","other"],"not_affected_if":[],"how_to_check":"- Check the installed Firefox version with `firefox --version` or Help > About Firefox; the sources do not give the affected range beyond the fixed releases.","fix":"- Update Firefox to `159` or later, or Firefox ESR to `153.6` or later.","status":"open","published_at":"2026-10-27T14:16:57+00:00","first_seen_at":"2026-10-27T14:32:25+00:00","triaged_at":"2026-10-27T14:33:41+00:00","updated_at":"2026-10-27T14:33:41+00:00","category":"other","confidence":0.5,"triage":{"at":"2026-10-27T14:33:41Z","model":"claude-haiku-5-5","output":{"fix":"- Update Firefox to `159` or later, or Firefox ESR to `153.6` or later.","reach":"unknown","title":"Firefox: race condition in Networking component leaks information","impact":"low","summary":"A race condition in the Firefox Networking component can expose information to an attacker. The fix is in Firefox 159 and Firefox ESR 153.6.","category":"other","nicknames":[],"who_cares":["firefox","desktop-browsers"],"confidence":0.5,"needs_auth":"unknown","worst_case":"Information from the browser networking layer is disclosed to an attacker.","analyst_note":"Check the NVD entry and Mozilla's advisory for the specific trigger, affected version range and whether user interaction is needed.","how_to_check":"- Check the installed Firefox version with `firefox --version` or Help > About Firefox; the sources do not give the affected range beyond the fixed releases.","needs_analyst":true,"not_affected_if":[],"who_is_affected":"unknown. The sources do not say which configurations or content are needed to trigger the race. Any team running Firefox or Firefox ESR on a version before the fixed releases should treat it as in scope.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000546,"input_tokens":3238,"output_tokens":444,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-118002':11A,14A '-2026':10A,13A '153.6':42B,63C '159':38B,59C 'attack':32B 'browser':17B 'compon':6A,26B,52C 'condit':3A,21B,48C 'cve':9A,12A 'desktop':16B 'desktop-brows':15B 'disclosur':44C 'due':45C 'esr':41B,62C 'expos':28B 'firefox':1A,18B,24B,37B,40B,58C,61C 'fix':34B,56C 'inform':8A,29B,43C 'leak':7A 'network':5A,25B,51C 'race':2A,20B,47C 'vulner':54C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-27T14:16:57+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-118002","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118002","severity":null,"published_at":"2026-10-27T14:16:57+00:00","modified_at":"2026-10-27T14:16:57+00:00","first_seen_at":"2026-10-27T14:32:25+00:00","fetched_at":"2026-10-27T14:32:25+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}