{"id":"CVE-2026-118004","kind":"vulnerability","aliases":["CVE-2026-118004"],"related":[],"title":"Firefox: CSS animation boundary flaw fixed in Firefox 159 and ESR 153.6","description":"Incorrect boundary conditions in the CSS Transitions and Animations component. This vulnerability was fixed in Firefox 159 and Firefox ESR 153.6.","summary":"Firefox's CSS Transitions and Animations component had an incorrect boundary condition, per the NVD entry. The sources do not say what an attacker gains from it beyond the fix being shipped in Firefox 159 and Firefox ESR 153.6.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["desktop-browser","firefox","runtime"],"not_affected_if":[],"how_to_check":"- Run `about:support` in Firefox and read the version line, then compare it with `159` or `153.6` (ESR)\n- unknown","fix":"- Update Firefox to `159` or Firefox ESR to `153.6`\n- unknown","status":"open","published_at":"2026-10-27T14:16:58+00:00","first_seen_at":"2026-10-27T14:32:25+00:00","triaged_at":"2026-10-27T14:33:39+00:00","updated_at":"2026-10-27T14:33:39+00:00","category":"runtime","confidence":0.35,"triage":{"at":"2026-10-27T14:33:39Z","model":"claude-haiku-5-5","output":{"fix":"- Update Firefox to `159` or Firefox ESR to `153.6`\n- unknown","reach":"unknown","title":"Firefox: CSS animation boundary flaw fixed in Firefox 159 and ESR 153.6","impact":"medium","summary":"Firefox's CSS Transitions and Animations component had an incorrect boundary condition, per the NVD entry. The sources do not say what an attacker gains from it beyond the fix being shipped in Firefox 159 and Firefox ESR 153.6.","category":"runtime","nicknames":[],"who_cares":["firefox","desktop-browser"],"confidence":0.35,"needs_auth":"unknown","worst_case":"unknown; the sources do not describe the memory or logic effect","analyst_note":"Check the Mozilla security advisory for the Firefox 159 and ESR 153.6 release to learn the actual impact and whether web content can trigger it.","how_to_check":"- Run `about:support` in Firefox and read the version line, then compare it with `159` or `153.6` (ESR)\n- unknown","needs_analyst":true,"not_affected_if":[],"who_is_affected":"Any installation of Firefox older than the fixed releases is affected, according to the description. The sources do not say what conditions make a page or user exposed, or whether the flaw is reachable without interaction. unknown","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000577,"input_tokens":3254,"output_tokens":503,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-118004':15A,18A '-2026':14A,17A '153.6':12A,62B,83C '159':9A,58B,79C 'anim':3A,29B,71C 'attack':47B 'beyond':51B 'boundari':4A,34B,64C 'browser':21B 'compon':30B,72C 'condit':35B,65C 'css':2A,26B,68C 'cve':13A,16A 'desktop':20B 'desktop-brows':19B 'entri':39B 'esr':11A,61B,82C 'firefox':1A,8A,22B,24B,57B,60B,78C,81C 'fix':6A,53B,76C 'flaw':5A 'gain':48B 'incorrect':33B,63C 'nvd':38B 'per':36B 'runtim':23B 'say':44B 'ship':55B 'sourc':41B 'transit':27B,69C 'vulner':74C","nicknames":[],"mitigations":[],"who_affected":"Any installation of Firefox older than the fixed releases is affected, according to the description. The sources do not say what conditions make a page or user exposed, or whether the flaw is reachable without interaction. unknown","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-27T14:16:58+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-118004","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118004","severity":null,"published_at":"2026-10-27T14:16:58+00:00","modified_at":"2026-10-27T14:16:58+00:00","first_seen_at":"2026-10-27T14:32:25+00:00","fetched_at":"2026-10-27T14:32:25+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}