CVEsMozillaCVE-2026-118027Published Oct 27, 14:06 · Updated Oct 27, 14:06 UTC
–
Not scored
CVE-2026-118027

Frame poisoning in the Layout component

Firefox
AffectedFirefox
FixUpdate to 115.44 or newer
PublishedOct 27, 14:06 · mozilla
ScoredNot yet
Exploit code publicNone known · checked 21:18 UTC
ExploitedNone known · CISA KEV checked 22:09 UTC

What we know

No known exploitation. CISA KEV, checked 22:09 UTC.
No public exploit code known. Exploit-DB, Metasploit, Nuclei, checked 21:18 UTC.
No severity score yet.

Description

Frame poisoning in the Layout component. This vulnerability was fixed in Firefox ESR 115.44.

From mozilla

Affected and fixed versions

ProductAffectedFixed inFirefoxNot affected115.44

Exploit code

Exploit-DBnone knownMetasploitnone knownNucleinone known

References

bugzilla.mozilla.org/show_bug.cgi?id=2045606 · bugzilla.mozilla.orgwww.mozilla.org/security/advisories/mfsa2026-119/ · mozilla.org

Other CVEs in Firefox

All 1,852 →
–Invalid pointer in the JavaScript: GC component · CVE-2026-118026Oct 27–Other issue in the SVG component · CVE-2026-118025Oct 27–Use-after-free in the Graphics: Text component · CVE-2026-118024Oct 27