8.8
High
CVE-2026-117864 Sandbox escape in the Form Manager component
Description
Sandbox escape in the Form Manager component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
CVSS 3.1 detail
Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HExploitable remotely over the network, without an account and if a user takes an action; an attacker can seriously compromise confidentiality, integrity or availability.
- Attack vector
- Network
- Attack complexity
- Low
- Privileges required
- None
- Interaction
- Required
- Scope
- Unchanged
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Firefox 159 | earliest → < 159 | 159 |
| Firefox 153.6 | earliest → < 153.6 | 153.6 |
| Thunderbird 159 | earliest → < 159 | 159 |
| Thunderbird 153.6 | earliest → < 153.6 | 153.6 |