What the public record says

Mozilla credited me as the reporter for CVE-2026-118002, an information disclosure caused by a race condition in Firefox's Networking component. The issue is tracked as Bug 2073584 and was fixed in Firefox 159 (MFSA 2026-118). The CVE record also lists Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6. The public advisory rates the impact as low.

In Firefox's NTLM handling, a race could cause the browser to send the logged-in user's credentials to an untrusted host. That is a credential disclosure issue: an attacker who can trigger the race and control the destination could capture NTLM authentication material.

Low severity does not always mean low impact. NTLM material can be relayed or cracked depending on the environment. The published severity reflects the difficulty and preconditions, not the value of the credential to an attacker.

Why NTLM disclosure matters

NTLM is an authentication protocol. If a browser sends NTLM credentials to a host the user did not intend to authenticate to, the receiving host can capture the exchange. In the wrong environment, that material can be used for relay or offline cracking.

The interesting part of this bug is not a single payload. It is the timing: a race in protocol handling can produce a security-relevant state that is hard to see in a normal request/response trace. Reproducing it requires a harness, patience, and a clear model of what the browser is supposed to do.

What I can share

  • The affected component is Networking.
  • The issue is a race condition leading to information disclosure.
  • The impact is NTLM credential disclosure to an untrusted host.
  • Mozilla fixed it in Firefox 159 and published MFSA 2026-118.

The technical details remain private in Bugzilla. I am not publishing a proof of concept or exploit steps. The advisory and CVE record are the public source of truth.

Disclosure timeline

  • Reported Mozilla receives the NTLM race issue and assigns Bug 2073584.
  • 2026-10-27 MFSA 2026-118 publishes the Firefox 159 fix and CVE-2026-118002.
  • Now The public record is available; technical details remain private.

What I learned

Race conditions in protocol handlers are difficult to reproduce reliably. A single successful run is not enough. You need a harness that can repeat the timing window, plus a clear explanation of the security property that failed.

The report also has to separate reproduction difficulty from business impact. A low CVSS score is not a reason to skip the fix if the affected environment treats NTLM credentials as sensitive.

References