CVE-2026-117960
Spoofing issue in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thund
CVSS
4.7
Medio
EPSS
0.3%
p22
KEV
—
Exploit Today
7
0-100
Publicado: 27 oct 2026 · Última mod.: 5 nov 2026 · CWE-451
0.2%EPSS · 30 días0.3%
2026-10-282026-11-07
Spoofing issue in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
- bugzilla.mozilla.orghttps://bugzilla.mozilla.org/show_bug.cgi?id=2067647
- www.mozilla.orghttps://www.mozilla.org/security/advisories/mfsa2026-118/
- www.mozilla.orghttps://www.mozilla.org/security/advisories/mfsa2026-120/
- www.mozilla.orghttps://www.mozilla.org/security/advisories/mfsa2026-121/
- www.mozilla.orghttps://www.mozilla.org/security/advisories/mfsa2026-122/
CVECVSSEPSSKEVRExplotTítuloVis.
CVE-2026-1239954.6 MED2.8%
——1Hisense VIDAA Smart TV firmware V0000.01.00a.P0220 contains an input validation vulnerability in the UPnP/DLNA AVTransport SOAP service that allows a LAN-adjacent attacker to inject arbitrary URIs via the CurrentURI field of SetAVTransportURI without validating the scheme, host, or media legitimacy. Attackers can supply schemes such as http://, file:///data/misc/wifi/, rtsp://, or smb:// to have the TV fetch and render attacker-controlled content after a one-time DLNA pairing, enabling phishing pages, fake firmware prompts, and fake emergency alerts to be displayed, with subsequent commands executing silently.2dCVE-2026-1212445.4 MED9.7%
——3UI misrepresentation in FileAPI in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium)3dCVE-2026-1212165.4 MED9.7%
——3UI misrepresentation in UI in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium)3dCVE-2026-1212155.4 MED9.1%
——3UI misrepresentation in Bluetooth in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium)3dCVE-2026-121209—8.1%
——2UI misrepresentation in Input in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to spoof address bar via a crafted HTML page. (Chromium security severity: Low)5dCVE-2026-1212065.4 MED9.7%
——3UI misrepresentation in Isolated in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Low)3d