{"id":"CVE-2026-118003","kind":"vulnerability","aliases":["CVE-2026-118003"],"related":[],"title":"Firefox: DNS networking flaw leaks information to attackers","description":"Information disclosure in the Networking: DNS component. This vulnerability was fixed in Firefox 159 and Firefox ESR 153.6.","summary":"A flaw in the DNS networking component of Firefox can disclose information. The sources do not say what data leaks or how an attacker triggers it.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["desktop-browsers","firefox","other"],"not_affected_if":["already-on-fixed-version"],"how_to_check":"- Check the installed Firefox version with `firefox --version` or the About Firefox page.\n- Compare it against the fixed releases: Firefox 159 and Firefox ESR 153.6.","fix":"- Update Firefox to `159` or later.\n- Update Firefox ESR to `153.6` or later.","status":"open","published_at":"2026-10-27T14:16:58+00:00","first_seen_at":"2026-10-27T14:32:25+00:00","triaged_at":"2026-10-27T14:33:42+00:00","updated_at":"2026-10-27T14:33:42+00:00","category":"other","confidence":0.4,"triage":{"at":"2026-10-27T14:33:42Z","model":"claude-haiku-5-5","output":{"fix":"- Update Firefox to `159` or later.\n- Update Firefox ESR to `153.6` or later.","reach":"unknown","title":"Firefox: DNS networking flaw leaks information to attackers","impact":"low","summary":"A flaw in the DNS networking component of Firefox can disclose information. The sources do not say what data leaks or how an attacker triggers it.","category":"other","nicknames":[],"who_cares":["firefox","desktop-browsers"],"confidence":0.4,"needs_auth":"unknown","worst_case":"unknown information disclosure from the browser's DNS handling","analyst_note":"Find the Mozilla advisory for this CVE to learn what data leaks and how it is triggered.","how_to_check":"- Check the installed Firefox version with `firefox --version` or the About Firefox page.\n- Compare it against the fixed releases: Firefox 159 and Firefox ESR 153.6.","needs_analyst":true,"not_affected_if":["already-on-fixed-version"],"who_is_affected":"Teams whose staff or systems run Firefox builds older than 159 or ESR older than 153.6 are exposed. The sources do not say which configurations or settings matter, so the exact exposure is unknown. Systems already running the fixed releases can skip it.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000564,"input_tokens":3236,"output_tokens":481,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-118003':11A,14A '-2026':10A,13A '153.6':61C '159':57C 'attack':8A,42B 'browser':17B 'compon':25B,50C 'cve':9A,12A 'data':37B 'desktop':16B 'desktop-brows':15B 'disclos':29B 'disclosur':45C 'dns':2A,23B,49C 'esr':60C 'firefox':1A,18B,27B,56C,59C 'fix':54C 'flaw':4A,20B 'inform':6A,30B,44C 'leak':5A,38B 'network':3A,24B,48C 'say':35B 'sourc':32B 'trigger':43B 'vulner':52C","nicknames":[],"mitigations":[],"who_affected":"Teams whose staff or systems run Firefox builds older than 159 or ESR older than 153.6 are exposed. The sources do not say which configurations or settings matter, so the exact exposure is unknown. Systems already running the fixed releases can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-27T14:16:58+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-118003","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118003","severity":null,"published_at":"2026-10-27T14:16:58+00:00","modified_at":"2026-10-27T14:16:58+00:00","first_seen_at":"2026-10-27T14:32:25+00:00","fetched_at":"2026-10-27T14:32:25+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}