High priorityDisclosed

Advisory · CVE-2026-118008

Privilege escalation in Firefox DOM navigation component fixed in Firefox 159

Mozilla Firefox before 159 contains a privilege escalation flaw in the DOM: Navigation component that CISA's scoring rates CVSS 3.1 8.8, fixed in Firefox 159 and Thunderbird 159. CVSS 3.1 8.8.

Advisory published October 27, 2026Independent summary
Vendor
Mozilla
Product
Firefox
Identifier / CWE
CVE-2026-118008
CWE-269
Action timing
Immediate
ELI5

Explain it like I’m five

A bug in how the browser handles navigation lets web content climb from the web page's low-privilege world into a more powerful part of the browser. Visiting the wrong page with an older build is enough to start that climb.

SIMPLIFIED_ATTACK_PATH03 STEPS
  1. 01Victim visits content

    The victim opens attacker content in an affected Firefox build.

  2. 02Navigation flaw triggers

    The content exercises the privilege escalation flaw in the DOM: Navigation component.

  3. 03Browser privilege boundary crossed

    The attack gains privileges beyond the web content context.

What happened

Mozilla published CVE-2026-118008 on October 27, 2026 in advisory MFSA2026-118: a privilege escalation flaw in the DOM: Navigation component. CISA’s ADP scoring in the NVD record rates it high at CVSS 3.1 8.8, network-reachable with user interaction. Mozilla’s record does not publish further exploitation detail, so this advisory does not add any.

Per Mozilla’s record, the vulnerability was fixed in Firefox 159 and Thunderbird 159. Unlike several other flaws in the same release, this record does not list an ESR fix, so ESR users should check the MFSA for their branch’s status.

What to do

  1. Inventory Firefox and Thunderbird installations across managed endpoints and note versions.
  2. Update Firefox and Thunderbird to 159 or later; ESR estates should confirm the fix status for their branch in MFSA2026-118.
  3. Force a browser restart after updating so the patched build is the running build.
  4. Review endpoint telemetry for browser crash clusters or unexpected child processes.
  5. Verify the running version after updating, including on shared machines.

Management note

Browser privilege escalation is the first half of most modern exploit chains. The fix exists in the new release; the work is making sure every endpoint is actually running it, not just entitled to it.