Firefox/Thunderbird Console Component Vulnerability (pre 159): CVE-2026-117977 October 2026

Firefox/Thunderbird Console Component Vulnerability (pre 159)
CVE-2026-117977 Published on October 27, 2026

Other issue in the Console component
Other issue in the Console component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

Vulnerability Analysis

CVE-2026-117977 can be exploited with network access, requires user interaction. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have a high impact on confidentiality and integrity, and no impact on availability.

Attack Vector:

NETWORK

Attack Complexity:

LOW

Privileges Required:

NONE

User Interaction:

REQUIRED

Scope:

UNCHANGED

Confidentiality Impact:

HIGH

Integrity Impact:

HIGH

Availability Impact:

NONE

Weakness Type

Improper Output Neutralization for Logs

The software does not neutralize or incorrectly neutralizes output that is written to logs.

Products Associated with CVE-2026-117977

stack.watch emails you whenever new vulnerabilities are published in Mozilla Firefox or Mozilla Thunderbird. Just hit a watch button to start following.

Affected Versions

Version 153.6, <= 153.* is unaffected.

Version 159, <= * is unaffected.