---
id: "CVE-2026-120572"
kind: "vulnerability"
aliases: ["CVE-2026-120572"]
title: "Firefox: layout engine boundary bug in Block and Inline component"
severity: "unknown"
cvss: null
epss: null
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["browsers", "desktop", "firefox", "runtime"]
not_affected_if: ["firefox-at-or-above-159.0.1"]
published_at: "2026-11-03T14:17:35+00:00"
first_seen_at: "2026-11-03T14:21:08+00:00"
updated_at: "2026-11-03T14:22:08+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-120572", "first_seen_at": "2026-11-03T14:21:08+00:00"}]
---

# Firefox: layout engine boundary bug in Block and Inline component

Firefox's layout code, in the Block and Inline component, mishandles boundary conditions. The sources do not state what an attacker can do with it.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Firefox version with Help > About Firefox, or `firefox --version` on the command line.
- Compare it against the fixed version named in the sources: `159.0.1`.

## Fix

- Firefox: `159.0.1` or later

## Timeline

- 2026-11-03T14:21:08+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-120572

## From the sources

Incorrect boundary conditions in the Layout: Block and Inline component. This vulnerability was fixed in Firefox 159.0.1.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_