Insufficient verification of data authenticity in Mozilla products - CVE-2026-117960
Published: October 27, 2026
Vulnerability identifier: #VU158172
CSH Severity: Low
CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-117960
CWE-ID: CWE-345
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to present misleading content and potentially deceive users.
The vulnerability exists due to insufficient authenticity enforcement in the DOM: Core & HTML component when presenting web content. A remote attacker can supply crafted content to spoof its presentation and potentially mislead users about its authenticity.
Affected software
Firefox ESR
Mozilla Firefox
Firefox for Android
Mozilla Firefox
Firefox for Android
How to mitigate CVE-2026-117960
Install security update from vendor's website.
Firefox ESR - update to 153.6.0
Firefox for Android - update to 159.0
Mozilla Firefox - update to 159.0
Firefox for Android - update to 159.0
Mozilla Firefox - update to 159.0