CVE-2026-118027

CriticalCVSS 9.1

Published: 27/10/2026(UTC)Updated: 04/11/2026(UTC)Translated: 27/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.26%

17th percentile - higher than 17% of all known CVEs

Summary

Frame poisoning in the Layout component. This vulnerability was fixed in Firefox ESR 115.44.

Risk Assessment

The vulnerability may allow manipulation of page content or unintended actions within the browser context. This may impact integrity or confidentiality of user data.

Recommendation

Update Firefox ESR to version 115.44 or later. Apply the update as soon as possible.

Other vulnerabilities in Firefox ESR

CVE-2023-25746High
Memory safety bugs are present in Firefox ESR 102.7. Some of these bugs showed evidence of memory corruption and it is presumed that with enough effort some could have been exploited to run arbitrary code. The vulnerability affects Thunderbird < 102.8 and Firefox ESR < 102.8.

Original NVD description (English source)

Frame poisoning in the Layout component. This vulnerability was fixed in Firefox ESR 115.44.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS