{"id":"CVE-2026-118008","kind":"vulnerability","aliases":["CVE-2026-118008"],"related":[],"title":"Firefox: DOM Navigation flaw allows privilege escalation, fixed in 159","description":"Privilege escalation in the DOM: Navigation component. This vulnerability was fixed in Firefox 159.","summary":"A flaw in the DOM Navigation component of Firefox lets a page or script gain privileges it should not have. The sources do not describe the exact exploit path or the scope of the privileges gained.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["browser","desktop","firefox","runtime"],"not_affected_if":["firefox-159-or-later"],"how_to_check":"- Check the installed Firefox version: `firefox --version` or Help > About Firefox\n- Unknown whether other checks apply; the sources do not say","fix":"- Update Firefox to `159` or later\n- Unknown whether a configuration change is needed as a workaround","status":"open","published_at":"2026-10-27T14:16:58+00:00","first_seen_at":"2026-10-27T14:32:25+00:00","triaged_at":"2026-10-27T14:33:36+00:00","updated_at":"2026-10-27T14:33:36+00:00","category":"runtime","confidence":0.4,"triage":{"at":"2026-10-27T14:33:36Z","model":"claude-haiku-5-5","output":{"fix":"- Update Firefox to `159` or later\n- Unknown whether a configuration change is needed as a workaround","reach":"unknown","title":"Firefox: DOM Navigation flaw allows privilege escalation, fixed in 159","impact":"high","summary":"A flaw in the DOM Navigation component of Firefox lets a page or script gain privileges it should not have. The sources do not describe the exact exploit path or the scope of the privileges gained.","category":"runtime","nicknames":[],"who_cares":["firefox","desktop","browser"],"confidence":0.4,"needs_auth":"unknown","worst_case":"Attacker gains elevated privileges inside the browser; exact scope unknown","analyst_note":"Find the Mozilla security advisory for this CVE to confirm the privilege scope, required user interaction, and whether the flaw is reachable from web content.","how_to_check":"- Check the installed Firefox version: `firefox --version` or Help > About Firefox\n- Unknown whether other checks apply; the sources do not say","needs_analyst":true,"not_affected_if":["firefox-159-or-later"],"who_is_affected":"Teams that run Firefox builds older than version 159, including desktop installs and any managed fleet pinned to older releases. The sources do not say which platforms or configurations are most exposed. Teams already on Firefox 159 or later are not affected.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000579,"input_tokens":3227,"output_tokens":512,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-118008':13A,16A '-2026':12A,15A '159':10A,70C 'allow':5A 'browser':17B 'compon':27B,63C 'cve':11A,14A 'describ':45B 'desktop':18B 'dom':2A,25B,61C 'escal':7A,58C 'exact':47B 'exploit':48B 'firefox':1A,19B,29B,69C 'fix':8A,67C 'flaw':4A,22B 'gain':35B,56B 'let':30B 'navig':3A,26B,62C 'page':32B 'path':49B 'privileg':6A,36B,55B,57C 'runtim':20B 'scope':52B 'script':34B 'sourc':42B 'vulner':65C","nicknames":[],"mitigations":[],"who_affected":"Teams that run Firefox builds older than version 159, including desktop installs and any managed fleet pinned to older releases. The sources do not say which platforms or configurations are most exposed. Teams already on Firefox 159 or later are not affected.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-27T14:16:58+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-118008","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118008","severity":null,"published_at":"2026-10-27T14:16:58+00:00","modified_at":"2026-10-27T14:16:58+00:00","first_seen_at":"2026-10-27T14:32:25+00:00","fetched_at":"2026-10-27T14:32:25+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}