Live › vulnerability › CVE-2026-118011
Go to dashboardA flaw in Firefox's CSS parsing and computation component allows frame poisoning, a memory corruption condition in how the browser handles style data. The sources do not state what an attacker can achieve beyond that, and the fix is in Firefox 159.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-27 14:32 UTC. All times on this page are UTC.
Anyone running Firefox older than version 159 is affected, since the fix ships in that release. Systems that run only current Firefox builds or other browsers can skip it. Whether the flaw is reachable from a web page alone is unknown from the sources.
No product ranges from the sources yet.
firefox --version or check Help > About Firefox and compare against 159159 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Frame poisoning in the CSS Parsing and Computation component. This vulnerability was fixed in Firefox 159.
This page as .md · .json · in your agent: get_signal("CVE-2026-118011")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.