CVE-2026-117912 vulnerability in Mozilla Products

CVE-2026-117912 vulnerability in Mozilla Products
Published on October 27, 2026

Same-origin policy bypass in the CSS Parsing and Computation component

Same-origin policy bypass in the CSS Parsing and Computation component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

Vulnerability Analysis

CVE-2026-117912 is exploitable with network access, requires user interaction. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have a high impact on confidentiality and integrity, and no impact on availability.

Attack Vector:

NETWORK

Attack Complexity:

LOW

Privileges Required:

NONE

User Interaction:

REQUIRED

Scope:

UNCHANGED

Confidentiality Impact:

HIGH

Integrity Impact:

HIGH

Availability Impact:

NONE

Weakness Type

Origin Validation Error

The software does not properly verify that the source of data or communication is valid.

Products Associated with CVE-2026-117912

stack.watch emails you whenever new vulnerabilities are published in Mozilla Firefox or Mozilla Thunderbird. Just hit a watch button to start following.

Affected Versions

Version 115.44, <= 115.* is unaffected.

Version 153.6, <= 153.* is unaffected.

Version 159, <= * is unaffected.