CVE-2026-117912 in Firefox
Summary
by MITRE • 10/27/2026
Same-origin policy bypass in the CSS Parsing and Computation component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, and Firefox ESR 153.6.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/27/2026
The identified vulnerability represents a critical failure within the browser's Same-Origin Policy enforcement mechanisms, specifically located in the CSS Parsing and Computation subsystem. The Same-Origin Policy is a fundamental security concept that restricts how a document or script loaded from one origin can interact with resources from another origin. By bypassing this policy through maliciously crafted Cascading Style Sheets, an attacker gains the ability to read sensitive data belonging to other origins, effectively breaking the isolation boundaries that protect user privacy and application integrity. This flaw allows cross-origin data exfiltration under conditions where such access should be strictly prohibited by standard browser security models.
From a technical perspective, the root cause lies in how the rendering engine processes CSS properties during computation phases. When parsing specific or malformed style rules, the engine fails to correctly validate whether the computed values expose information about resources from different origins. This could involve leaking details such as font metrics, image dimensions, or other stylistic attributes that are derived from cross-origin assets. The vulnerability exploits inconsistencies in how stylesheets are applied and resolved against elements on a page, allowing an attacker to construct a scenario where style-based side channels reveal private data without triggering standard security exceptions.
The operational impact of this flaw is significant for users browsing untrusted or malicious websites. An adversary hosting a webpage could leverage this bypass to extract sensitive information from other tabs or windows open in the same browser instance. This includes personal identifiable information, financial details, session tokens, or proprietary content hosted on different domains. Since CSS-based attacks often operate silently without user interaction beyond visiting the page, victims may remain unaware that their data is being exfiltrated. The severity of this issue is compounded by its potential use in conjunction with other vulnerabilities to create complex attack chains targeting high-value targets such as enterprise environments or financial institutions.
This vulnerability aligns closely with CWE-200, which classifies exposure of sensitive information to an unauthorized actor, and falls under the ATT&CK technique T1537, involving data exfiltration over a alternative protocol using browser-based methods like CSS injection. It also relates to CWE-862 regarding missing authorization checks within the context of origin validation logic. The flaw highlights the complexity of maintaining strict security boundaries in modern web browsers where multiple subsystems interact dynamically during page rendering.
Mitigation for this issue has been addressed through updates released by Mozilla, specifically in Firefox version 159 and Extended Support Release versions 115.44 and 153.6. Organizations relying on these browser distributions must ensure that all endpoints are updated to the patched versions immediately to close the security gap. For environments where immediate patching is not feasible, temporary mitigations may include restricting user ability to navigate to untrusted sites or deploying web application firewalls that can detect and block known patterns of CSS-based data exfiltration attempts. Continuous monitoring for anomalous network traffic originating from browser processes can also help in identifying potential exploitation activities before significant damage occurs.