Vulnerability-Lookup

ALSA-2026:89757 (CVE-2026-109704)

Vulnerability from osv_almalinux – Published: 2026-10-26 00:00 – Updated: 2026-10-31 12:54 – Source website

Summary

Important: firefox security, bug fix, and enhancement update

Details

Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability.

Security Fix(es):

libexpat: denial of service via crafted XML input (CVE-2026-45186)
firefox: thunderbird: Privilege escalation in the Application Update component (CVE-2026-109704)
firefox: Use-after-free in the XML component (CVE-2026-109718)
firefox: Information disclosure in the PDF Viewer component (CVE-2026-109742)
firefox: Incorrect boundary conditions in the JavaScript Engine component (CVE-2026-109715)
firefox: firefox: Sandbox escape via incorrect boundary conditions in Win32 widget (CVE-2026-109740)
firefox: Use-after-free in the Storage: IndexedDB component (CVE-2026-109706)
firefox: Use-after-free in the Crash Reporting component (CVE-2026-109713)
firefox: Use-after-free in the DOM: Core & HTML component (CVE-2026-109724)
firefox: Sandbox escape due to uninitialized memory in the DOM: Web Serial component (CVE-2026-109745)
firefox: Mitigation bypass in the File Handling component (CVE-2026-109782)
firefox: Information disclosure, privilege escalation in the Security: Process Sandboxing component (CVE-2026-109709)
firefox: Sandbox escape, site isolation issue due to incorrect boundary conditions, use-after-free in the Networking component (CVE-2026-109705)
firefox: Use-after-free in the Audio/Video: Playback component (CVE-2026-109738)
firefox: Sandbox escape due to race condition in the Networking component (CVE-2026-109757)
firefox: Use-after-free in the Storage: Bucket File System component (CVE-2026-109741)
firefox: Use-after-free in the JavaScript Engine: JIT component (CVE-2026-109729)
firefox: Other issue in the DOM: File component (CVE-2026-109744)
firefox: Incorrect boundary conditions in the JavaScript Engine component (CVE-2026-109716)
firefox: Race condition, use-after-free in the Graphics: CanvasWebGL component (CVE-2026-109719)
firefox: Incorrect boundary conditions in the Layout component (CVE-2026-109753)
firefox: Integer overflow in the Layout: Text and Fonts component (CVE-2026-109723)
firefox: Privilege escalation in the DOM: Navigation component (CVE-2026-109756)
firefox: JIT miscompilation in the JavaScript Engine: JIT component (CVE-2026-109733)
firefox: Mitigation bypass in the File Handling component (CVE-2026-109763)
firefox: Sandbox escape due to incorrect boundary conditions in the Networking component (CVE-2026-109708)
firefox: Use-after-free in the DOM: Bindings (WebIDL) component (CVE-2026-109717)
firefox: Use-after-free in the DOM: Workers component (CVE-2026-109752)
firefox: Sandbox escape due to use-after-free in the Networking component (CVE-2026-109707)
firefox: Mitigation bypass in the Networking: HTTP component (CVE-2026-109760)
firefox: JIT miscompilation in the JavaScript: WebAssembly component (CVE-2026-109720)
firefox: Use-after-free in the SVG component (CVE-2026-109726)
firefox: Integer overflow in the Graphics component (CVE-2026-109730)
firefox: Use-after-free in the Audio/Video component (CVE-2026-109727)
firefox: Mitigation bypass in the Enterprise Policies component (CVE-2026-109737)
firefox: Use-after-free in the DOM: Streams component (CVE-2026-109732)
firefox: Site isolation issue in the Networking component (CVE-2026-109759)
firefox: Incorrect boundary conditions in the SVG component (CVE-2026-109762)
firefox: Incorrect boundary conditions in the DOM: Editor component (CVE-2026-109754)
firefox: Information disclosure in the Networking component (CVE-2026-109751)
firefox: Use-after-free in the DOM: Core & HTML component (CVE-2026-109725)
firefox: Sandbox escape due to uninitialized memory in the Graphics component (CVE-2026-109712)
firefox: Use-after-free in the Graphics: Canvas2D component (CVE-2026-109711)
firefox: Frame poisoning in the Layout component (CVE-2026-109736)
firefox: JIT miscompilation in the JavaScript Engine: JIT component (CVE-2026-109722)
firefox: Use-after-free in the DOM: Animation component (CVE-2026-109728)
firefox: Incorrect boundary conditions in the JavaScript Engine: JIT component (CVE-2026-109721)
firefox: Privilege escalation in the Panning and Zooming component (CVE-2026-109743)

Bug Fix(es) and Enhancement(s):

Firefox ESR 153 rebase [rhel-9.8.z] (JIRA:RHEL-175155)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

References

URL

Type

	https://access.redhat.com/errata/RHSA-2026:89757	ADVISORY
	https://access.redhat.com/security/cve/CVE-2026-109704	REPORT
	https://access.redhat.com/security/cve/CVE-2026-109705	REPORT
	https://access.redhat.com/security/cve/CVE-2026-109706	REPORT
	https://access.redhat.com/security/cve/CVE-2026-109707	REPORT
	https://access.redhat.com/security/cve/CVE-2026-109708	REPORT
	https://access.redhat.com/security/cve/CVE-2026-109709	REPORT
	https://access.redhat.com/security/cve/CVE-2026-109711	REPORT
	https://access.redhat.com/security/cve/CVE-2026-109712	REPORT
	https://access.redhat.com/security/cve/CVE-2026-109713	REPORT
	https://access.redhat.com/security/cve/CVE-2026-109715	REPORT
	https://access.redhat.com/security/cve/CVE-2026-109716	REPORT
	https://access.redhat.com/security/cve/CVE-2026-109717	REPORT
	https://access.redhat.com/security/cve/CVE-2026-109718	REPORT
	https://access.redhat.com/security/cve/CVE-2026-109719	REPORT
	https://access.redhat.com/security/cve/CVE-2026-109720	REPORT
	https://access.redhat.com/security/cve/CVE-2026-109721	REPORT
	https://access.redhat.com/security/cve/CVE-2026-109722	REPORT
	https://access.redhat.com/security/cve/CVE-2026-109723	REPORT
	https://access.redhat.com/security/cve/CVE-2026-109724	REPORT
	https://access.redhat.com/security/cve/CVE-2026-109725	REPORT
	https://access.redhat.com/security/cve/CVE-2026-109726	REPORT
	https://access.redhat.com/security/cve/CVE-2026-109727	REPORT
	https://access.redhat.com/security/cve/CVE-2026-109728	REPORT
	https://access.redhat.com/security/cve/CVE-2026-109729	REPORT
	https://access.redhat.com/security/cve/CVE-2026-109730	REPORT
	https://access.redhat.com/security/cve/CVE-2026-109732	REPORT
	https://access.redhat.com/security/cve/CVE-2026-109733	REPORT
	https://access.redhat.com/security/cve/CVE-2026-109736	REPORT
	https://access.redhat.com/security/cve/CVE-2026-109737	REPORT
	https://access.redhat.com/security/cve/CVE-2026-109738	REPORT
	https://access.redhat.com/security/cve/CVE-2026-109740	REPORT
	https://access.redhat.com/security/cve/CVE-2026-109741	REPORT
	https://access.redhat.com/security/cve/CVE-2026-109742	REPORT
	https://access.redhat.com/security/cve/CVE-2026-109743	REPORT
	https://access.redhat.com/security/cve/CVE-2026-109744	REPORT
	https://access.redhat.com/security/cve/CVE-2026-109745	REPORT
	https://access.redhat.com/security/cve/CVE-2026-109751	REPORT
	https://access.redhat.com/security/cve/CVE-2026-109752	REPORT
	https://access.redhat.com/security/cve/CVE-2026-109753	REPORT
	https://access.redhat.com/security/cve/CVE-2026-109754	REPORT
	https://access.redhat.com/security/cve/CVE-2026-109756	REPORT
	https://access.redhat.com/security/cve/CVE-2026-109757	REPORT
	https://access.redhat.com/security/cve/CVE-2026-109759	REPORT
	https://access.redhat.com/security/cve/CVE-2026-109760	REPORT
	https://access.redhat.com/security/cve/CVE-2026-109762	REPORT
	https://access.redhat.com/security/cve/CVE-2026-109763	REPORT
	https://access.redhat.com/security/cve/CVE-2026-109782	REPORT
	https://access.redhat.com/security/cve/CVE-2026-45186	REPORT
	https://bugzilla.redhat.com/2468575	REPORT
	https://bugzilla.redhat.com/2550397	REPORT
	https://bugzilla.redhat.com/2550404	REPORT
	https://bugzilla.redhat.com/2550405	REPORT
	https://bugzilla.redhat.com/2550413	REPORT
	https://bugzilla.redhat.com/2550419	REPORT
	https://bugzilla.redhat.com/2550420	REPORT
	https://bugzilla.redhat.com/2550424	REPORT
	https://bugzilla.redhat.com/2550433	REPORT
	https://bugzilla.redhat.com/2550438	REPORT
	https://bugzilla.redhat.com/2550446	REPORT
	https://bugzilla.redhat.com/2550451	REPORT
	https://bugzilla.redhat.com/2550455	REPORT
	https://errata.almalinux.org/9/ALSA-2026-89757.html	ADVISORY

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "AlmaLinux:9",
        "name": "firefox"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "153.5.0-1.el9_8"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:9",
        "name": "firefox-x11"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "153.5.0-1.el9_8"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "details": "Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability.  \n\nSecurity Fix(es):  \n\n  * libexpat: denial of service via crafted XML input (CVE-2026-45186)\n  * firefox: thunderbird: Privilege escalation in the Application Update component (CVE-2026-109704)\n  * firefox: Use-after-free in the XML component (CVE-2026-109718)\n  * firefox: Information disclosure in the PDF Viewer component (CVE-2026-109742)\n  * firefox: Incorrect boundary conditions in the JavaScript Engine component (CVE-2026-109715)\n  * firefox: firefox: Sandbox escape via incorrect boundary conditions in Win32 widget (CVE-2026-109740)\n  * firefox: Use-after-free in the Storage: IndexedDB component (CVE-2026-109706)\n  * firefox: Use-after-free in the Crash Reporting component (CVE-2026-109713)\n  * firefox: Use-after-free in the DOM: Core \u0026 HTML component (CVE-2026-109724)\n  * firefox: Sandbox escape due to uninitialized memory in the DOM: Web Serial component (CVE-2026-109745)\n  * firefox: Mitigation bypass in the File Handling component (CVE-2026-109782)\n  * firefox: Information disclosure, privilege escalation in the Security: Process Sandboxing component (CVE-2026-109709)\n  * firefox: Sandbox escape, site isolation issue due to incorrect boundary conditions, use-after-free in the Networking component (CVE-2026-109705)\n  * firefox: Use-after-free in the Audio/Video: Playback component (CVE-2026-109738)\n  * firefox: Sandbox escape due to race condition in the Networking component (CVE-2026-109757)\n  * firefox: Use-after-free in the Storage: Bucket File System component (CVE-2026-109741)\n  * firefox: Use-after-free in the JavaScript Engine: JIT component (CVE-2026-109729)\n  * firefox: Other issue in the DOM: File component (CVE-2026-109744)\n  * firefox: Incorrect boundary conditions in the JavaScript Engine component (CVE-2026-109716)\n  * firefox: Race condition, use-after-free in the Graphics: CanvasWebGL component (CVE-2026-109719)\n  * firefox: Incorrect boundary conditions in the Layout component (CVE-2026-109753)\n  * firefox: Integer overflow in the Layout: Text and Fonts component (CVE-2026-109723)\n  * firefox: Privilege escalation in the DOM: Navigation component (CVE-2026-109756)\n  * firefox: JIT miscompilation in the JavaScript Engine: JIT component (CVE-2026-109733)\n  * firefox: Mitigation bypass in the File Handling component (CVE-2026-109763)\n  * firefox: Sandbox escape due to incorrect boundary conditions in the Networking component (CVE-2026-109708)\n  * firefox: Use-after-free in the DOM: Bindings (WebIDL) component (CVE-2026-109717)\n  * firefox: Use-after-free in the DOM: Workers component (CVE-2026-109752)\n  * firefox: Sandbox escape due to use-after-free in the Networking component (CVE-2026-109707)\n  * firefox: Mitigation bypass in the Networking: HTTP component (CVE-2026-109760)\n  * firefox: JIT miscompilation in the JavaScript: WebAssembly component (CVE-2026-109720)\n  * firefox: Use-after-free in the SVG component (CVE-2026-109726)\n  * firefox: Integer overflow in the Graphics component (CVE-2026-109730)\n  * firefox: Use-after-free in the Audio/Video component (CVE-2026-109727)\n  * firefox: Mitigation bypass in the Enterprise Policies component (CVE-2026-109737)\n  * firefox: Use-after-free in the DOM: Streams component (CVE-2026-109732)\n  * firefox: Site isolation issue in the Networking component (CVE-2026-109759)\n  * firefox: Incorrect boundary conditions in the SVG component (CVE-2026-109762)\n  * firefox: Incorrect boundary conditions in the DOM: Editor component (CVE-2026-109754)\n  * firefox: Information disclosure in the Networking component (CVE-2026-109751)\n  * firefox: Use-after-free in the DOM: Core \u0026 HTML component (CVE-2026-109725)\n  * firefox: Sandbox escape due to uninitialized memory in the Graphics component (CVE-2026-109712)\n  * firefox: Use-after-free in the Graphics: Canvas2D component (CVE-2026-109711)\n  * firefox: Frame poisoning in the Layout component (CVE-2026-109736)\n  * firefox: JIT miscompilation in the JavaScript Engine: JIT component (CVE-2026-109722)\n  * firefox: Use-after-free in the DOM: Animation component (CVE-2026-109728)\n  * firefox: Incorrect boundary conditions in the JavaScript Engine: JIT component (CVE-2026-109721)\n  * firefox: Privilege escalation in the Panning and Zooming component (CVE-2026-109743)\n\n\nBug Fix(es) and Enhancement(s):  \n\n  * Firefox ESR 153 rebase [rhel-9.8.z] (JIRA:RHEL-175155)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n",
  "id": "ALSA-2026:89757",
  "modified": "2026-10-31T12:54:27Z",
  "published": "2026-10-26T00:00:00Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://access.redhat.com/errata/RHSA-2026:89757"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-109704"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-109705"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-109706"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-109707"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-109708"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-109709"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-109711"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-109712"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-109713"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-109715"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-109716"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-109717"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-109718"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-109719"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-109720"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-109721"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-109722"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-109723"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-109724"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-109725"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-109726"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-109727"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-109728"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-109729"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-109730"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-109732"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-109733"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-109736"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-109737"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-109738"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-109740"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-109741"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-109742"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-109743"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-109744"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-109745"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-109751"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-109752"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-109753"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-109754"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-109756"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-109757"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-109759"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-109760"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-109762"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-109763"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-109782"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-45186"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2468575"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2550397"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2550404"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2550405"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2550413"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2550419"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2550420"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2550424"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2550433"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2550438"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2550446"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2550451"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2550455"
    },
    {
      "type": "ADVISORY",
      "url": "https://errata.almalinux.org/9/ALSA-2026-89757.html"
    }
  ],
  "related": [
    "CVE-2026-109704",
    "CVE-2026-109705",
    "CVE-2026-109706",
    "CVE-2026-109707",
    "CVE-2026-109708",
    "CVE-2026-109709",
    "CVE-2026-109711",
    "CVE-2026-109712",
    "CVE-2026-109713",
    "CVE-2026-109715",
    "CVE-2026-109716",
    "CVE-2026-109717",
    "CVE-2026-109718",
    "CVE-2026-109719",
    "CVE-2026-109720",
    "CVE-2026-109721",
    "CVE-2026-109722",
    "CVE-2026-109723",
    "CVE-2026-109724",
    "CVE-2026-109725",
    "CVE-2026-109726",
    "CVE-2026-109727",
    "CVE-2026-109728",
    "CVE-2026-109729",
    "CVE-2026-109730",
    "CVE-2026-109732",
    "CVE-2026-109733",
    "CVE-2026-109736",
    "CVE-2026-109737",
    "CVE-2026-109738",
    "CVE-2026-109740",
    "CVE-2026-109741",
    "CVE-2026-109742",
    "CVE-2026-109743",
    "CVE-2026-109744",
    "CVE-2026-109745",
    "CVE-2026-109751",
    "CVE-2026-109752",
    "CVE-2026-109753",
    "CVE-2026-109754",
    "CVE-2026-109756",
    "CVE-2026-109757",
    "CVE-2026-109759",
    "CVE-2026-109760",
    "CVE-2026-109762",
    "CVE-2026-109763",
    "CVE-2026-109782",
    "CVE-2026-45186"
  ],
  "schema_version": "1.7.0",
  "summary": "Important: firefox security, bug fix, and enhancement update",
  "upstream": [
    "CVE-2026-109704",
    "CVE-2026-109705",
    "CVE-2026-109706",
    "CVE-2026-109707",
    "CVE-2026-109708",
    "CVE-2026-109709",
    "CVE-2026-109711",
    "CVE-2026-109712",
    "CVE-2026-109713",
    "CVE-2026-109715",
    "CVE-2026-109716",
    "CVE-2026-109717",
    "CVE-2026-109718",
    "CVE-2026-109719",
    "CVE-2026-109720",
    "CVE-2026-109721",
    "CVE-2026-109722",
    "CVE-2026-109723",
    "CVE-2026-109724",
    "CVE-2026-109725",
    "CVE-2026-109726",
    "CVE-2026-109727",
    "CVE-2026-109728",
    "CVE-2026-109729",
    "CVE-2026-109730",
    "CVE-2026-109732",
    "CVE-2026-109733",
    "CVE-2026-109736",
    "CVE-2026-109737",
    "CVE-2026-109738",
    "CVE-2026-109740",
    "CVE-2026-109741",
    "CVE-2026-109742",
    "CVE-2026-109743",
    "CVE-2026-109744",
    "CVE-2026-109745",
    "CVE-2026-109751",
    "CVE-2026-109752",
    "CVE-2026-109753",
    "CVE-2026-109754",
    "CVE-2026-109756",
    "CVE-2026-109757",
    "CVE-2026-109759",
    "CVE-2026-109760",
    "CVE-2026-109762",
    "CVE-2026-109763",
    "CVE-2026-109782",
    "CVE-2026-45186"
  ]
}

CVE-2026-109704 (GCVE-0-2026-109704)

Vulnerability from cvelistv5 – Published: 2026-10-13 12:29 – Updated: 2026-10-14 15:55

Title

Privilege escalation in the Application Update component

Summary

Privilege escalation in the Application Update component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.

Severity

8.8 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-14 03:59 UTC

CWE

CWE-269 - Improper Privilege Management

Assigner

mozilla CNA under the mitre root

CNA scorecard E 38/100 over 679 records in the last 180 days details

References

5 references

URL	Tags
https://bugzilla.mozilla.org/show_bug.cgi?id=2037979
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…

Impacted products

2 products

Vendor	Product	Version
Mozilla	Firefox	Unaffected: 153.5 , ≤ 153.* (rpm) Unaffected: 158 , ≤ * (rpm)
Mozilla	Thunderbird	Unaffected: 153.5 , ≤ 153.* (rpm) Unaffected: 158 , ≤ * (rpm)

Credits

Noel

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 8.8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-109704",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-14T03:59:07.345013Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-269",
                "description": "CWE-269 Improper Privilege Management",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-14T15:55:36.887Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Firefox",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "153.*",
              "status": "unaffected",
              "version": "153.5",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "158",
              "versionType": "rpm"
            }
          ]
        },
        {
          "product": "Thunderbird",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "153.*",
              "status": "unaffected",
              "version": "153.5",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "158",
              "versionType": "rpm"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Noel"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Privilege escalation in the Application Update component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5."
            }
          ],
          "value": "Privilege escalation in the Application Update component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-13T18:16:45.734Z",
        "orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
        "shortName": "mozilla"
      },
      "references": [
        {
          "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2037979"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-106/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-108/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-109/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-110/"
        }
      ],
      "title": "Privilege escalation in the Application Update component"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
    "assignerShortName": "mozilla",
    "cveId": "CVE-2026-109704",
    "datePublished": "2026-10-13T12:29:21.681Z",
    "dateReserved": "2026-10-13T00:29:13.930Z",
    "dateUpdated": "2026-10-14T15:55:36.887Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-109705 (GCVE-0-2026-109705)

Vulnerability from cvelistv5 – Published: 2026-10-13 12:29 – Updated: 2026-10-27 14:05

Title

Sandbox escape, site isolation issue due to incorrect boundary conditions, use-after-free in the Networking component

Summary

Sandbox escape, site isolation issue due to incorrect boundary conditions, use-after-free in the Networking component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, Thunderbird 153.5, and Firefox ESR 115.44.

Severity

9.6 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-13 14:14 UTC

CWE

CWE-416 - Use After Free

Assigner

mozilla CNA under the mitre root

CNA scorecard E 38/100 over 679 records in the last 180 days details

References

6 references

URL	Tags
https://bugzilla.mozilla.org/show_bug.cgi?id=2040905
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…

Impacted products

2 products

Vendor	Product	Version
Mozilla	Firefox	Unaffected: 115.44 , ≤ 115.* (rpm) Unaffected: 153.5 , ≤ 153.* (rpm) Unaffected: 158 , ≤ * (rpm)
Mozilla	Thunderbird	Unaffected: 153.5 , ≤ 153.* (rpm) Unaffected: 158 , ≤ * (rpm)

Credits

Mozilla

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 9.6,
              "baseSeverity": "CRITICAL",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "CHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-109705",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-13T14:14:35.331154Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-416",
                "description": "CWE-416 Use After Free",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-13T14:16:45.347Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Firefox",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "115.*",
              "status": "unaffected",
              "version": "115.44",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "153.*",
              "status": "unaffected",
              "version": "153.5",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "158",
              "versionType": "rpm"
            }
          ]
        },
        {
          "product": "Thunderbird",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "153.*",
              "status": "unaffected",
              "version": "153.5",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "158",
              "versionType": "rpm"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Mozilla"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Sandbox escape, site isolation issue due to incorrect boundary conditions, use-after-free in the Networking component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, Thunderbird 153.5, and Firefox ESR 115.44."
            }
          ],
          "value": "Sandbox escape, site isolation issue due to incorrect boundary conditions, use-after-free in the Networking component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, Thunderbird 153.5, and Firefox ESR 115.44."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-27T14:05:57.372Z",
        "orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
        "shortName": "mozilla"
      },
      "references": [
        {
          "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2040905"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-106/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-108/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-109/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-110/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-119/"
        }
      ],
      "title": "Sandbox escape, site isolation issue due to incorrect boundary conditions, use-after-free in the Networking component"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
    "assignerShortName": "mozilla",
    "cveId": "CVE-2026-109705",
    "datePublished": "2026-10-13T12:29:21.887Z",
    "dateReserved": "2026-10-13T00:29:14.767Z",
    "dateUpdated": "2026-10-27T14:05:57.372Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-109706 (GCVE-0-2026-109706)

Vulnerability from cvelistv5 – Published: 2026-10-13 12:29 – Updated: 2026-10-13 18:16

Title

Use-after-free in the Storage: IndexedDB component

Summary

Use-after-free in the Storage: IndexedDB component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.

Severity

5.4 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-13 14:13 UTC

CWE

CWE-416 - Use After Free

Assigner

mozilla CNA under the mitre root

CNA scorecard E 38/100 over 679 records in the last 180 days details

References

6 references

URL	Tags
https://bugzilla.mozilla.org/show_bug.cgi?id=2053649
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…

Impacted products

2 products

Vendor	Product	Version
Mozilla	Firefox	Unaffected: 115.43 , ≤ 115.* (rpm) Unaffected: 153.5 , ≤ 153.* (rpm) Unaffected: 158 , ≤ * (rpm)
Mozilla	Thunderbird	Unaffected: 153.5 , ≤ 153.* (rpm) Unaffected: 158 , ≤ * (rpm)

Credits

Mozilla

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 5.4,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "LOW",
              "integrityImpact": "LOW",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-109706",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-13T14:13:43.002640Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-416",
                "description": "CWE-416 Use After Free",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-13T14:18:51.473Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Firefox",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "115.*",
              "status": "unaffected",
              "version": "115.43",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "153.*",
              "status": "unaffected",
              "version": "153.5",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "158",
              "versionType": "rpm"
            }
          ]
        },
        {
          "product": "Thunderbird",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "153.*",
              "status": "unaffected",
              "version": "153.5",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "158",
              "versionType": "rpm"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Mozilla"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Use-after-free in the Storage: IndexedDB component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5."
            }
          ],
          "value": "Use-after-free in the Storage: IndexedDB component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-13T18:16:25.637Z",
        "orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
        "shortName": "mozilla"
      },
      "references": [
        {
          "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2053649"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-106/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-107/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-108/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-109/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-110/"
        }
      ],
      "title": "Use-after-free in the Storage: IndexedDB component"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
    "assignerShortName": "mozilla",
    "cveId": "CVE-2026-109706",
    "datePublished": "2026-10-13T12:29:17.664Z",
    "dateReserved": "2026-10-13T00:29:15.656Z",
    "dateUpdated": "2026-10-13T18:16:25.637Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-109707 (GCVE-0-2026-109707)

Vulnerability from cvelistv5 – Published: 2026-10-13 12:29 – Updated: 2026-10-27 14:05

Title

Sandbox escape due to use-after-free in the Networking component

Summary

Sandbox escape due to use-after-free in the Networking component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, Thunderbird 153.5, and Firefox ESR 115.44.

Severity

9.6 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-13 14:14 UTC

CWE

CWE-416 - Use After Free

Assigner

mozilla CNA under the mitre root

CNA scorecard E 38/100 over 679 records in the last 180 days details

References

6 references

URL	Tags
https://bugzilla.mozilla.org/show_bug.cgi?id=2059150
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…

Impacted products

2 products

Vendor	Product	Version
Mozilla	Firefox	Unaffected: 115.44 , ≤ 115.* (rpm) Unaffected: 153.5 , ≤ 153.* (rpm) Unaffected: 158 , ≤ * (rpm)
Mozilla	Thunderbird	Unaffected: 153.5 , ≤ 153.* (rpm) Unaffected: 158 , ≤ * (rpm)

Credits

Mozilla

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 9.6,
              "baseSeverity": "CRITICAL",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "CHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-109707",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-13T14:14:07.332362Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-416",
                "description": "CWE-416 Use After Free",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-13T14:14:20.053Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Firefox",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "115.*",
              "status": "unaffected",
              "version": "115.44",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "153.*",
              "status": "unaffected",
              "version": "153.5",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "158",
              "versionType": "rpm"
            }
          ]
        },
        {
          "product": "Thunderbird",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "153.*",
              "status": "unaffected",
              "version": "153.5",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "158",
              "versionType": "rpm"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Mozilla"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Sandbox escape due to use-after-free in the Networking component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, Thunderbird 153.5, and Firefox ESR 115.44."
            }
          ],
          "value": "Sandbox escape due to use-after-free in the Networking component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, Thunderbird 153.5, and Firefox ESR 115.44."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-27T14:05:57.668Z",
        "orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
        "shortName": "mozilla"
      },
      "references": [
        {
          "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2059150"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-106/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-108/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-109/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-110/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-119/"
        }
      ],
      "title": "Sandbox escape due to use-after-free in the Networking component"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
    "assignerShortName": "mozilla",
    "cveId": "CVE-2026-109707",
    "datePublished": "2026-10-13T12:29:22.122Z",
    "dateReserved": "2026-10-13T00:29:16.501Z",
    "dateUpdated": "2026-10-27T14:05:57.668Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-109708 (GCVE-0-2026-109708)

Vulnerability from cvelistv5 – Published: 2026-10-13 12:29 – Updated: 2026-10-27 14:05

Title

Sandbox escape due to incorrect boundary conditions in the Networking component

Summary

Sandbox escape due to incorrect boundary conditions in the Networking component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, Thunderbird 153.5, and Firefox ESR 115.44.

Severity

9.6 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-15 19:52 UTC

CWE

CWE-119 - Improper Restriction of Operations within the Bounds of a Memory Buffer

Assigner

mozilla CNA under the mitre root

CNA scorecard E 38/100 over 679 records in the last 180 days details

References

6 references

URL	Tags
https://bugzilla.mozilla.org/show_bug.cgi?id=2059151
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…

Impacted products

2 products

Vendor	Product	Version
Mozilla	Firefox	Unaffected: 115.44 , ≤ 115.* (rpm) Unaffected: 153.5 , ≤ 153.* (rpm) Unaffected: 158 , ≤ * (rpm)
Mozilla	Thunderbird	Unaffected: 153.5 , ≤ 153.* (rpm) Unaffected: 158 , ≤ * (rpm)

Credits

Mozilla

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 9.6,
              "baseSeverity": "CRITICAL",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "CHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-109708",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-15T19:52:36.695793Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-119",
                "description": "CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-15T19:52:39.911Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Firefox",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "115.*",
              "status": "unaffected",
              "version": "115.44",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "153.*",
              "status": "unaffected",
              "version": "153.5",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "158",
              "versionType": "rpm"
            }
          ]
        },
        {
          "product": "Thunderbird",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "153.*",
              "status": "unaffected",
              "version": "153.5",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "158",
              "versionType": "rpm"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Mozilla"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Sandbox escape due to incorrect boundary conditions in the Networking component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, Thunderbird 153.5, and Firefox ESR 115.44."
            }
          ],
          "value": "Sandbox escape due to incorrect boundary conditions in the Networking component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, Thunderbird 153.5, and Firefox ESR 115.44."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-27T14:05:57.979Z",
        "orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
        "shortName": "mozilla"
      },
      "references": [
        {
          "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2059151"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-106/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-108/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-109/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-110/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-119/"
        }
      ],
      "title": "Sandbox escape due to incorrect boundary conditions in the Networking component"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
    "assignerShortName": "mozilla",
    "cveId": "CVE-2026-109708",
    "datePublished": "2026-10-13T12:29:22.338Z",
    "dateReserved": "2026-10-13T00:29:17.366Z",
    "dateUpdated": "2026-10-27T14:05:57.979Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-109709 (GCVE-0-2026-109709)

Vulnerability from cvelistv5 – Published: 2026-10-13 12:29 – Updated: 2026-10-14 03:59

Title

Information disclosure, privilege escalation in the Security: Process Sandboxing component

Summary

Information disclosure, privilege escalation in the Security: Process Sandboxing component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.

Severity

8.8 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-13 00:00 UTC

CWE

CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor

Assigner

mozilla CNA under the mitre root

CNA scorecard E 38/100 over 679 records in the last 180 days details

References

5 references

URL	Tags
https://bugzilla.mozilla.org/show_bug.cgi?id=2067976
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…

Impacted products

2 products

Vendor	Product	Version
Mozilla	Firefox	Unaffected: 153.5 , ≤ 153.* (rpm) Unaffected: 158 , ≤ * (rpm)
Mozilla	Thunderbird	Unaffected: 153.5 , ≤ 153.* (rpm) Unaffected: 158 , ≤ * (rpm)

Credits

Yaqoub Aldurayhim

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 8.8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-109709",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-13T00:00:00+00:00",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-200",
                "description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-14T03:59:07.648Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Firefox",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "153.*",
              "status": "unaffected",
              "version": "153.5",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "158",
              "versionType": "rpm"
            }
          ]
        },
        {
          "product": "Thunderbird",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "153.*",
              "status": "unaffected",
              "version": "153.5",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "158",
              "versionType": "rpm"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Yaqoub Aldurayhim"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Information disclosure, privilege escalation in the Security: Process Sandboxing component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5."
            }
          ],
          "value": "Information disclosure, privilege escalation in the Security: Process Sandboxing component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-13T18:16:49.921Z",
        "orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
        "shortName": "mozilla"
      },
      "references": [
        {
          "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2067976"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-106/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-108/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-109/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-110/"
        }
      ],
      "title": "Information disclosure, privilege escalation in the Security: Process Sandboxing component"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
    "assignerShortName": "mozilla",
    "cveId": "CVE-2026-109709",
    "datePublished": "2026-10-13T12:29:22.541Z",
    "dateReserved": "2026-10-13T00:29:18.217Z",
    "dateUpdated": "2026-10-14T03:59:07.648Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-109711 (GCVE-0-2026-109711)

Vulnerability from cvelistv5 – Published: 2026-10-13 12:29 – Updated: 2026-10-13 18:16

Title

Use-after-free in the Graphics: Canvas2D component

Summary

Use-after-free in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.

Severity

5.4 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-13 14:13 UTC

CWE

CWE-416 - Use After Free

Assigner

mozilla CNA under the mitre root

CNA scorecard E 38/100 over 679 records in the last 180 days details

References

5 references

URL	Tags
https://bugzilla.mozilla.org/show_bug.cgi?id=2068344
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…

Impacted products

2 products

Vendor	Product	Version
Mozilla	Firefox	Unaffected: 153.5 , ≤ 153.* (rpm) Unaffected: 158 , ≤ * (rpm)
Mozilla	Thunderbird	Unaffected: 153.5 , ≤ 153.* (rpm) Unaffected: 158 , ≤ * (rpm)

Credits

Mozilla

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 5.4,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "LOW",
              "integrityImpact": "LOW",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-109711",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-13T14:13:25.574620Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-416",
                "description": "CWE-416 Use After Free",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-13T14:18:50.517Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Firefox",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "153.*",
              "status": "unaffected",
              "version": "153.5",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "158",
              "versionType": "rpm"
            }
          ]
        },
        {
          "product": "Thunderbird",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "153.*",
              "status": "unaffected",
              "version": "153.5",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "158",
              "versionType": "rpm"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Mozilla"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Use-after-free in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5."
            }
          ],
          "value": "Use-after-free in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-13T18:16:50.976Z",
        "orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
        "shortName": "mozilla"
      },
      "references": [
        {
          "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2068344"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-106/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-108/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-109/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-110/"
        }
      ],
      "title": "Use-after-free in the Graphics: Canvas2D component"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
    "assignerShortName": "mozilla",
    "cveId": "CVE-2026-109711",
    "datePublished": "2026-10-13T12:29:22.742Z",
    "dateReserved": "2026-10-13T00:29:19.916Z",
    "dateUpdated": "2026-10-13T18:16:50.976Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-109712 (GCVE-0-2026-109712)

Vulnerability from cvelistv5 – Published: 2026-10-13 12:29 – Updated: 2026-10-16 18:07

Title

Sandbox escape due to uninitialized memory in the Graphics component

Summary

Sandbox escape due to uninitialized memory in the Graphics component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.

Severity

7.1 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-16 18:07 UTC

CWE

CWE-908 - Use of Uninitialized Resource

Assigner

mozilla CNA under the mitre root

CNA scorecard E 38/100 over 679 records in the last 180 days details

References

6 references

URL	Tags
https://bugzilla.mozilla.org/show_bug.cgi?id=2068420
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…

Impacted products

2 products

Vendor	Product	Version
Mozilla	Firefox	Unaffected: 115.43 , ≤ 115.* (rpm) Unaffected: 153.5 , ≤ 153.* (rpm) Unaffected: 158 , ≤ * (rpm)
Mozilla	Thunderbird	Unaffected: 153.5 , ≤ 153.* (rpm) Unaffected: 158 , ≤ * (rpm)

Credits

Mozilla

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "LOW",
              "baseScore": 7.1,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "LOW",
              "integrityImpact": "LOW",
              "privilegesRequired": "NONE",
              "scope": "CHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-109712",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-16T18:07:41.211665Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-908",
                "description": "CWE-908 Use of Uninitialized Resource",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-16T18:07:45.538Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Firefox",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "115.*",
              "status": "unaffected",
              "version": "115.43",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "153.*",
              "status": "unaffected",
              "version": "153.5",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "158",
              "versionType": "rpm"
            }
          ]
        },
        {
          "product": "Thunderbird",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "153.*",
              "status": "unaffected",
              "version": "153.5",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "158",
              "versionType": "rpm"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Mozilla"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Sandbox escape due to uninitialized memory in the Graphics component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5."
            }
          ],
          "value": "Sandbox escape due to uninitialized memory in the Graphics component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-13T18:16:27.718Z",
        "orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
        "shortName": "mozilla"
      },
      "references": [
        {
          "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2068420"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-106/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-107/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-108/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-109/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-110/"
        }
      ],
      "title": "Sandbox escape due to uninitialized memory in the Graphics component"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
    "assignerShortName": "mozilla",
    "cveId": "CVE-2026-109712",
    "datePublished": "2026-10-13T12:29:18.170Z",
    "dateReserved": "2026-10-13T00:29:20.766Z",
    "dateUpdated": "2026-10-16T18:07:45.538Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-109713 (GCVE-0-2026-109713)

Vulnerability from cvelistv5 – Published: 2026-10-13 12:29 – Updated: 2026-10-13 18:16

Title

Use-after-free in the Crash Reporting component

Summary

Use-after-free in the Crash Reporting component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.

Severity

5.4 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-13 14:13 UTC

CWE

CWE-416 - Use After Free

Assigner

mozilla CNA under the mitre root

CNA scorecard E 38/100 over 679 records in the last 180 days details

References

5 references

URL	Tags
https://bugzilla.mozilla.org/show_bug.cgi?id=2068421
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…

Impacted products

2 products

Vendor	Product	Version
Mozilla	Firefox	Unaffected: 153.5 , ≤ 153.* (rpm) Unaffected: 158 , ≤ * (rpm)
Mozilla	Thunderbird	Unaffected: 153.5 , ≤ 153.* (rpm) Unaffected: 158 , ≤ * (rpm)

Credits

locust1b

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 5.4,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "LOW",
              "integrityImpact": "LOW",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-109713",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-13T14:13:07.817961Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-416",
                "description": "CWE-416 Use After Free",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-13T14:18:49.451Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Firefox",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "153.*",
              "status": "unaffected",
              "version": "153.5",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "158",
              "versionType": "rpm"
            }
          ]
        },
        {
          "product": "Thunderbird",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "153.*",
              "status": "unaffected",
              "version": "153.5",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "158",
              "versionType": "rpm"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "locust1b"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Use-after-free in the Crash Reporting component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5."
            }
          ],
          "value": "Use-after-free in the Crash Reporting component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-13T18:16:52.020Z",
        "orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
        "shortName": "mozilla"
      },
      "references": [
        {
          "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2068421"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-106/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-108/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-109/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-110/"
        }
      ],
      "title": "Use-after-free in the Crash Reporting component"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
    "assignerShortName": "mozilla",
    "cveId": "CVE-2026-109713",
    "datePublished": "2026-10-13T12:29:22.963Z",
    "dateReserved": "2026-10-13T00:29:21.579Z",
    "dateUpdated": "2026-10-13T18:16:52.020Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-109715 (GCVE-0-2026-109715)

Vulnerability from cvelistv5 – Published: 2026-10-13 12:29 – Updated: 2026-10-16 18:11

Title

Incorrect boundary conditions in the JavaScript Engine component

Summary

Incorrect boundary conditions in the JavaScript Engine component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.

Severity

8.1 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-16 18:10 UTC

CWE

CWE-119 - Improper Restriction of Operations within the Bounds of a Memory Buffer

Assigner

mozilla CNA under the mitre root

CNA scorecard E 38/100 over 679 records in the last 180 days details

References

6 references

URL	Tags
https://bugzilla.mozilla.org/show_bug.cgi?id=2073267
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…

Impacted products

2 products

Vendor	Product	Version
Mozilla	Firefox	Unaffected: 115.43 , ≤ 115.* (rpm) Unaffected: 153.5 , ≤ 153.* (rpm) Unaffected: 158 , ≤ * (rpm)
Mozilla	Thunderbird	Unaffected: 153.5 , ≤ 153.* (rpm) Unaffected: 158 , ≤ * (rpm)

Credits

Amy Burnett of OpenAI

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 8.1,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-109715",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-16T18:10:21.015891Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-119",
                "description": "CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-16T18:11:42.481Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Firefox",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "115.*",
              "status": "unaffected",
              "version": "115.43",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "153.*",
              "status": "unaffected",
              "version": "153.5",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "158",
              "versionType": "rpm"
            }
          ]
        },
        {
          "product": "Thunderbird",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "153.*",
              "status": "unaffected",
              "version": "153.5",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "158",
              "versionType": "rpm"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Amy Burnett of OpenAI"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Incorrect boundary conditions in the JavaScript Engine component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5."
            }
          ],
          "value": "Incorrect boundary conditions in the JavaScript Engine component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-13T18:16:28.754Z",
        "orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
        "shortName": "mozilla"
      },
      "references": [
        {
          "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2073267"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-106/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-107/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-108/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-109/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-110/"
        }
      ],
      "title": "Incorrect boundary conditions in the JavaScript Engine component"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
    "assignerShortName": "mozilla",
    "cveId": "CVE-2026-109715",
    "datePublished": "2026-10-13T12:29:18.421Z",
    "dateReserved": "2026-10-13T00:29:23.238Z",
    "dateUpdated": "2026-10-16T18:11:42.481Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

How durations are calculated

Following the VTEM framework (Black Hat USA 2015), time to patch starts when the vendor or a coordinator was informed, total time to patch at discovery, and disclosure to patch at public disclosure; vendor response time runs from the report to its acknowledgement. Time to exploit and time unpatched start at the earliest discovery or report, falling back to public disclosure. Unpatched time ends at the first recorded patch, or the calculation time when no patch is recorded. Exploitation to patch shows the interval between those two events; a published proof of concept is a public exploit, not exploitation.

Each result shows its source dates. A negative interval means the end event came first; when date-only inputs leave the order open, the result says so. Date-only inputs are approximate. The earliest evidence wins: KEV report dates and sightings are labelled as such. Records describing another vulnerability are listed but never calculated from, and a PoC alone does not establish exploitation. Missing patch evidence does not prove that no patch exists. Filters below change the event list only.

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

ALSA-2026:89757 (CVE-2026-109704)

CVE-2026-109704 (GCVE-0-2026-109704)

CVE-2026-109705 (GCVE-0-2026-109705)

CVE-2026-109706 (GCVE-0-2026-109706)

CVE-2026-109707 (GCVE-0-2026-109707)

CVE-2026-109708 (GCVE-0-2026-109708)

CVE-2026-109709 (GCVE-0-2026-109709)

CVE-2026-109711 (GCVE-0-2026-109711)

CVE-2026-109712 (GCVE-0-2026-109712)

CVE-2026-109713 (GCVE-0-2026-109713)

CVE-2026-109715 (GCVE-0-2026-109715)

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour