{"id":"CVE-2026-118027","kind":"vulnerability","aliases":["CVE-2026-118027"],"related":[],"title":"Firefox: Layout frame poisoning flaw, fixed in ESR 115.44","description":"Frame poisoning in the Layout component. This vulnerability was fixed in Firefox ESR 115.44.","summary":"A frame poisoning flaw in the Layout component of Firefox ESR is described in the sources, which give no further technical detail. The sources do not say what an attacker gains from it.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["desktop","firefox","firefox-esr","other"],"not_affected_if":[],"how_to_check":"- Run `firefox --version` or check Help > About Firefox and compare against the ESR 115 line\n- unknown","fix":"- Update Firefox ESR to `115.44` or later\n- unknown","status":"open","published_at":"2026-10-27T14:17:00+00:00","first_seen_at":"2026-10-27T14:32:25+00:00","triaged_at":"2026-10-27T14:33:18+00:00","updated_at":"2026-10-27T14:33:18+00:00","category":"other","confidence":0.4,"triage":{"at":"2026-10-27T14:33:18Z","model":"claude-haiku-5-5","output":{"fix":"- Update Firefox ESR to `115.44` or later\n- unknown","reach":"unknown","title":"Firefox: Layout frame poisoning flaw, fixed in ESR 115.44","impact":"medium","summary":"A frame poisoning flaw in the Layout component of Firefox ESR is described in the sources, which give no further technical detail. The sources do not say what an attacker gains from it.","category":"other","nicknames":[],"who_cares":["firefox","firefox-esr","desktop"],"confidence":0.4,"needs_auth":"unknown","worst_case":"unknown; sources do not describe the impact","analyst_note":"Check the NVD entry (https://nvd.nist.gov/vuln/detail/CVE-2026-118027) and Mozilla's ESR 115.44 advisory for the attack vector, user interaction and CVSS score.","how_to_check":"- Run `firefox --version` or check Help > About Firefox and compare against the ESR 115 line\n- unknown","needs_analyst":true,"not_affected_if":[],"who_is_affected":"Teams running Firefox ESR 115 builds earlier than 115.44 on workstations or managed desktops are the ones the advisory points at. The sources do not say which configurations or usage patterns are required for exploitation.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000564,"input_tokens":3222,"output_tokens":483,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-118027':12A,15A '-2026':11A,14A '115.44':9A,65C 'attack':50B 'compon':28B,57C 'cve':10A,13A 'describ':33B 'desktop':16B 'detail':42B 'esr':8A,20B,31B,64C 'firefox':1A,17B,19B,30B,63C 'firefox-esr':18B 'fix':6A,61C 'flaw':5A,24B 'frame':3A,22B,52C 'gain':51B 'give':38B 'layout':2A,27B,56C 'poison':4A,23B,53C 'say':47B 'sourc':36B,44B 'technic':41B 'vulner':59C","nicknames":[],"mitigations":[],"who_affected":"Teams running Firefox ESR 115 builds earlier than 115.44 on workstations or managed desktops are the ones the advisory points at. The sources do not say which configurations or usage patterns are required for exploitation.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-27T14:17:00+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-118027","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118027","severity":null,"published_at":"2026-10-27T14:17:00+00:00","modified_at":"2026-10-27T14:17:00+00:00","first_seen_at":"2026-10-27T14:32:25+00:00","fetched_at":"2026-10-27T14:32:25+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}