Vulnerability-Lookup

CERTFR-2026-AVI-1305

Vulnerability from certfr_avis - Published: 2026-10-14 - Updated: 2026-10-14

De multiples vulnérabilités ont été découvertes dans les produits Mozilla. Certaines d'entre elles permettent à un attaquant de provoquer une élévation de privilèges, un déni de service à distance et une atteinte à la confidentialité des données.

Solutions

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

Impacted products

Vendor	Product	Description
Mozilla	Firefox	Firefox versions antérieures à 158
Mozilla	Firefox ESR	Firefox ESR versions antérieures à 115.43
Mozilla	Thunderbird	Thunderbird versions antérieures à 153.5
Mozilla	Thunderbird	Thunderbird versions antérieures à 158
Mozilla	Firefox ESR	Firefox ESR versions antérieures à 153.5

References

Title

Publication Time

CVE-2026-106016 (GCVE-0-2026-106016)

Vulnerability from cvelistv5 – Published: 2026-10-06 12:30 – Updated: 2026-10-13 18:08

Title

Mitigation bypass in the File Handling component

Summary

Mitigation bypass in the File Handling component. This vulnerability was fixed in Firefox 157.0.1 and Thunderbird 158.

Severity

9.8 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-07 21:00 UTC

CWE

CWE-693 - Protection Mechanism Failure

Assigner

mozilla CNA under the mitre root

CNA scorecard E 38/100 over 546 records in the last 180 days details

References

3 references

URL	Tags
https://bugzilla.mozilla.org/show_bug.cgi?id=2067465
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…

Impacted products

2 products

Vendor	Product	Version
Mozilla	Firefox	Unaffected: 157.0.1 , ≤ * (rpm)
Mozilla	Thunderbird	Unaffected: 158 , ≤ * (rpm)

Credits

Abdulrahman Alzahrani

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 9.8,
              "baseSeverity": "CRITICAL",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-106016",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-07T21:00:58.433280Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-693",
                "description": "CWE-693 Protection Mechanism Failure",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-07T22:06:36.468Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Firefox",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "157.0.1",
              "versionType": "rpm"
            }
          ]
        },
        {
          "product": "Thunderbird",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "158",
              "versionType": "rpm"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Abdulrahman Alzahrani"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Mitigation bypass in the File Handling component. This vulnerability was fixed in Firefox 157.0.1 and Thunderbird 158."
            }
          ],
          "value": "Mitigation bypass in the File Handling component. This vulnerability was fixed in Firefox 157.0.1 and Thunderbird 158."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-13T18:08:38.671Z",
        "orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
        "shortName": "mozilla"
      },
      "references": [
        {
          "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2067465"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-104/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-109/"
        }
      ],
      "title": "Mitigation bypass in the File Handling component"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
    "assignerShortName": "mozilla",
    "cveId": "CVE-2026-106016",
    "datePublished": "2026-10-06T12:30:49.897Z",
    "dateReserved": "2026-10-06T12:30:49.691Z",
    "dateUpdated": "2026-10-13T18:08:38.671Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-109704 (GCVE-0-2026-109704)

Vulnerability from cvelistv5 – Published: 2026-10-13 12:29 – Updated: 2026-10-14 15:55

Title

Privilege escalation in the Application Update component

Summary

Privilege escalation in the Application Update component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.

Severity

8.8 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-14 03:59 UTC

CWE

CWE-269 - Improper Privilege Management

Assigner

mozilla CNA under the mitre root

CNA scorecard E 38/100 over 546 records in the last 180 days details

References

5 references

URL	Tags
https://bugzilla.mozilla.org/show_bug.cgi?id=2037979
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…

Impacted products

2 products

Vendor	Product	Version
Mozilla	Firefox	Unaffected: 153.5 , ≤ 153.* (rpm) Unaffected: 158 , ≤ * (rpm)
Mozilla	Thunderbird	Unaffected: 153.5 , ≤ 153.* (rpm) Unaffected: 158 , ≤ * (rpm)

Credits

Noel

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 8.8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-109704",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-14T03:59:07.345013Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-269",
                "description": "CWE-269 Improper Privilege Management",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-14T15:55:36.887Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Firefox",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "153.*",
              "status": "unaffected",
              "version": "153.5",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "158",
              "versionType": "rpm"
            }
          ]
        },
        {
          "product": "Thunderbird",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "153.*",
              "status": "unaffected",
              "version": "153.5",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "158",
              "versionType": "rpm"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Noel"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Privilege escalation in the Application Update component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5."
            }
          ],
          "value": "Privilege escalation in the Application Update component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-13T18:16:45.734Z",
        "orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
        "shortName": "mozilla"
      },
      "references": [
        {
          "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2037979"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-106/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-108/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-109/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-110/"
        }
      ],
      "title": "Privilege escalation in the Application Update component"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
    "assignerShortName": "mozilla",
    "cveId": "CVE-2026-109704",
    "datePublished": "2026-10-13T12:29:21.681Z",
    "dateReserved": "2026-10-13T00:29:13.930Z",
    "dateUpdated": "2026-10-14T15:55:36.887Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-109705 (GCVE-0-2026-109705)

Vulnerability from cvelistv5 – Published: 2026-10-13 12:29 – Updated: 2026-10-13 18:16

Title

Sandbox escape, site isolation issue due to incorrect boundary conditions, use-after-free in the Networking component

Summary

Sandbox escape, site isolation issue due to incorrect boundary conditions, use-after-free in the Networking component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.

Severity

9.6 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-13 14:14 UTC

CWE

CWE-416 - Use After Free

Assigner

mozilla CNA under the mitre root

CNA scorecard E 38/100 over 546 records in the last 180 days details

References

5 references

URL	Tags
https://bugzilla.mozilla.org/show_bug.cgi?id=2040905
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…

Impacted products

2 products

Vendor	Product	Version
Mozilla	Firefox	Unaffected: 153.5 , ≤ 153.* (rpm) Unaffected: 158 , ≤ * (rpm)
Mozilla	Thunderbird	Unaffected: 153.5 , ≤ 153.* (rpm) Unaffected: 158 , ≤ * (rpm)

Credits

Mozilla

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 9.6,
              "baseSeverity": "CRITICAL",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "CHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-109705",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-13T14:14:35.331154Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-416",
                "description": "CWE-416 Use After Free",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-13T14:16:45.347Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Firefox",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "153.*",
              "status": "unaffected",
              "version": "153.5",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "158",
              "versionType": "rpm"
            }
          ]
        },
        {
          "product": "Thunderbird",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "153.*",
              "status": "unaffected",
              "version": "153.5",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "158",
              "versionType": "rpm"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Mozilla"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Sandbox escape, site isolation issue due to incorrect boundary conditions, use-after-free in the Networking component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5."
            }
          ],
          "value": "Sandbox escape, site isolation issue due to incorrect boundary conditions, use-after-free in the Networking component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-13T18:16:46.734Z",
        "orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
        "shortName": "mozilla"
      },
      "references": [
        {
          "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2040905"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-106/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-108/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-109/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-110/"
        }
      ],
      "title": "Sandbox escape, site isolation issue due to incorrect boundary conditions, use-after-free in the Networking component"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
    "assignerShortName": "mozilla",
    "cveId": "CVE-2026-109705",
    "datePublished": "2026-10-13T12:29:21.887Z",
    "dateReserved": "2026-10-13T00:29:14.767Z",
    "dateUpdated": "2026-10-13T18:16:46.734Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-109706 (GCVE-0-2026-109706)

Vulnerability from cvelistv5 – Published: 2026-10-13 12:29 – Updated: 2026-10-13 18:16

Title

Use-after-free in the Storage: IndexedDB component

Summary

Use-after-free in the Storage: IndexedDB component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.

Severity

5.4 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-13 14:13 UTC

CWE

CWE-416 - Use After Free

Assigner

mozilla CNA under the mitre root

CNA scorecard E 38/100 over 546 records in the last 180 days details

References

6 references

URL	Tags
https://bugzilla.mozilla.org/show_bug.cgi?id=2053649
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…

Impacted products

2 products

Vendor	Product	Version
Mozilla	Firefox	Unaffected: 115.43 , ≤ 115.* (rpm) Unaffected: 153.5 , ≤ 153.* (rpm) Unaffected: 158 , ≤ * (rpm)
Mozilla	Thunderbird	Unaffected: 153.5 , ≤ 153.* (rpm) Unaffected: 158 , ≤ * (rpm)

Credits

Mozilla

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 5.4,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "LOW",
              "integrityImpact": "LOW",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-109706",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-13T14:13:43.002640Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-416",
                "description": "CWE-416 Use After Free",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-13T14:18:51.473Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Firefox",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "115.*",
              "status": "unaffected",
              "version": "115.43",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "153.*",
              "status": "unaffected",
              "version": "153.5",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "158",
              "versionType": "rpm"
            }
          ]
        },
        {
          "product": "Thunderbird",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "153.*",
              "status": "unaffected",
              "version": "153.5",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "158",
              "versionType": "rpm"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Mozilla"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Use-after-free in the Storage: IndexedDB component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5."
            }
          ],
          "value": "Use-after-free in the Storage: IndexedDB component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-13T18:16:25.637Z",
        "orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
        "shortName": "mozilla"
      },
      "references": [
        {
          "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2053649"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-106/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-107/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-108/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-109/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-110/"
        }
      ],
      "title": "Use-after-free in the Storage: IndexedDB component"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
    "assignerShortName": "mozilla",
    "cveId": "CVE-2026-109706",
    "datePublished": "2026-10-13T12:29:17.664Z",
    "dateReserved": "2026-10-13T00:29:15.656Z",
    "dateUpdated": "2026-10-13T18:16:25.637Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-109707 (GCVE-0-2026-109707)

Vulnerability from cvelistv5 – Published: 2026-10-13 12:29 – Updated: 2026-10-13 18:16

Title

Sandbox escape due to use-after-free in the Networking component

Summary

Sandbox escape due to use-after-free in the Networking component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.

Severity

9.6 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-13 14:14 UTC

CWE

CWE-416 - Use After Free

Assigner

mozilla CNA under the mitre root

CNA scorecard E 38/100 over 546 records in the last 180 days details

References

5 references

URL	Tags
https://bugzilla.mozilla.org/show_bug.cgi?id=2059150
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…

Impacted products

2 products

Vendor	Product	Version
Mozilla	Firefox	Unaffected: 153.5 , ≤ 153.* (rpm) Unaffected: 158 , ≤ * (rpm)
Mozilla	Thunderbird	Unaffected: 153.5 , ≤ 153.* (rpm) Unaffected: 158 , ≤ * (rpm)

Credits

Mozilla

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 9.6,
              "baseSeverity": "CRITICAL",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "CHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-109707",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-13T14:14:07.332362Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-416",
                "description": "CWE-416 Use After Free",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-13T14:14:20.053Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Firefox",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "153.*",
              "status": "unaffected",
              "version": "153.5",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "158",
              "versionType": "rpm"
            }
          ]
        },
        {
          "product": "Thunderbird",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "153.*",
              "status": "unaffected",
              "version": "153.5",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "158",
              "versionType": "rpm"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Mozilla"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Sandbox escape due to use-after-free in the Networking component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5."
            }
          ],
          "value": "Sandbox escape due to use-after-free in the Networking component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-13T18:16:47.895Z",
        "orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
        "shortName": "mozilla"
      },
      "references": [
        {
          "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2059150"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-106/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-108/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-109/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-110/"
        }
      ],
      "title": "Sandbox escape due to use-after-free in the Networking component"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
    "assignerShortName": "mozilla",
    "cveId": "CVE-2026-109707",
    "datePublished": "2026-10-13T12:29:22.122Z",
    "dateReserved": "2026-10-13T00:29:16.501Z",
    "dateUpdated": "2026-10-13T18:16:47.895Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-109708 (GCVE-0-2026-109708)

Vulnerability from cvelistv5 – Published: 2026-10-13 12:29 – Updated: 2026-10-13 18:16

Title

Sandbox escape due to incorrect boundary conditions in the Networking component

Summary

Sandbox escape due to incorrect boundary conditions in the Networking component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.

Severity

No CVSS data available.

Assigner

mozilla CNA under the mitre root

CNA scorecard E 38/100 over 546 records in the last 180 days details

References

5 references

URL	Tags
https://bugzilla.mozilla.org/show_bug.cgi?id=2059151
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…

Impacted products

2 products

Vendor	Product	Version
Mozilla	Firefox	Unaffected: 153.5 , ≤ 153.* (rpm) Unaffected: 158 , ≤ * (rpm)
Mozilla	Thunderbird	Unaffected: 153.5 , ≤ 153.* (rpm) Unaffected: 158 , ≤ * (rpm)

Credits

Mozilla

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "Firefox",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "153.*",
              "status": "unaffected",
              "version": "153.5",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "158",
              "versionType": "rpm"
            }
          ]
        },
        {
          "product": "Thunderbird",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "153.*",
              "status": "unaffected",
              "version": "153.5",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "158",
              "versionType": "rpm"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Mozilla"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Sandbox escape due to incorrect boundary conditions in the Networking component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5."
            }
          ],
          "value": "Sandbox escape due to incorrect boundary conditions in the Networking component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-13T18:16:48.918Z",
        "orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
        "shortName": "mozilla"
      },
      "references": [
        {
          "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2059151"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-106/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-108/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-109/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-110/"
        }
      ],
      "title": "Sandbox escape due to incorrect boundary conditions in the Networking component"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
    "assignerShortName": "mozilla",
    "cveId": "CVE-2026-109708",
    "datePublished": "2026-10-13T12:29:22.338Z",
    "dateReserved": "2026-10-13T00:29:17.366Z",
    "dateUpdated": "2026-10-13T18:16:48.918Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-109709 (GCVE-0-2026-109709)

Vulnerability from cvelistv5 – Published: 2026-10-13 12:29 – Updated: 2026-10-14 03:59

Title

Information disclosure, privilege escalation in the Security: Process Sandboxing component

Summary

Information disclosure, privilege escalation in the Security: Process Sandboxing component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.

Severity

8.8 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-13 00:00 UTC

CWE

CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor

Assigner

mozilla CNA under the mitre root

CNA scorecard E 38/100 over 546 records in the last 180 days details

References

5 references

URL	Tags
https://bugzilla.mozilla.org/show_bug.cgi?id=2067976
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…

Impacted products

2 products

Vendor	Product	Version
Mozilla	Firefox	Unaffected: 153.5 , ≤ 153.* (rpm) Unaffected: 158 , ≤ * (rpm)
Mozilla	Thunderbird	Unaffected: 153.5 , ≤ 153.* (rpm) Unaffected: 158 , ≤ * (rpm)

Credits

Yaqoub Aldurayhim

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 8.8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-109709",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-13T00:00:00+00:00",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-200",
                "description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-14T03:59:07.648Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Firefox",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "153.*",
              "status": "unaffected",
              "version": "153.5",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "158",
              "versionType": "rpm"
            }
          ]
        },
        {
          "product": "Thunderbird",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "153.*",
              "status": "unaffected",
              "version": "153.5",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "158",
              "versionType": "rpm"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Yaqoub Aldurayhim"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Information disclosure, privilege escalation in the Security: Process Sandboxing component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5."
            }
          ],
          "value": "Information disclosure, privilege escalation in the Security: Process Sandboxing component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-13T18:16:49.921Z",
        "orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
        "shortName": "mozilla"
      },
      "references": [
        {
          "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2067976"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-106/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-108/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-109/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-110/"
        }
      ],
      "title": "Information disclosure, privilege escalation in the Security: Process Sandboxing component"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
    "assignerShortName": "mozilla",
    "cveId": "CVE-2026-109709",
    "datePublished": "2026-10-13T12:29:22.541Z",
    "dateReserved": "2026-10-13T00:29:18.217Z",
    "dateUpdated": "2026-10-14T03:59:07.648Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-109710 (GCVE-0-2026-109710)

Vulnerability from cvelistv5 – Published: 2026-10-13 12:29 – Updated: 2026-10-13 18:16

Title

Use-after-free in the Graphics: Text component

Summary

Use-after-free in the Graphics: Text component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.

Severity

5.4 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-13 14:13 UTC

CWE

CWE-416 - Use After Free

Assigner

mozilla CNA under the mitre root

CNA scorecard E 38/100 over 546 records in the last 180 days details

References

6 references

URL	Tags
https://bugzilla.mozilla.org/show_bug.cgi?id=2068338
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…

Impacted products

2 products

Vendor	Product	Version
Mozilla	Firefox	Unaffected: 115.43 , ≤ 115.* (rpm) Unaffected: 153.5 , ≤ 153.* (rpm) Unaffected: 158 , ≤ * (rpm)
Mozilla	Thunderbird	Unaffected: 153.5 , ≤ 153.* (rpm) Unaffected: 158 , ≤ * (rpm)

Credits

Mozilla

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 5.4,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "LOW",
              "integrityImpact": "LOW",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-109710",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-13T14:13:28.502664Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-416",
                "description": "CWE-416 Use After Free",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-13T14:18:50.650Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Firefox",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "115.*",
              "status": "unaffected",
              "version": "115.43",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "153.*",
              "status": "unaffected",
              "version": "153.5",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "158",
              "versionType": "rpm"
            }
          ]
        },
        {
          "product": "Thunderbird",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "153.*",
              "status": "unaffected",
              "version": "153.5",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "158",
              "versionType": "rpm"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Mozilla"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Use-after-free in the Graphics: Text component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5."
            }
          ],
          "value": "Use-after-free in the Graphics: Text component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-13T18:16:26.644Z",
        "orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
        "shortName": "mozilla"
      },
      "references": [
        {
          "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2068338"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-106/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-107/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-108/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-109/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-110/"
        }
      ],
      "title": "Use-after-free in the Graphics: Text component"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
    "assignerShortName": "mozilla",
    "cveId": "CVE-2026-109710",
    "datePublished": "2026-10-13T12:29:17.918Z",
    "dateReserved": "2026-10-13T00:29:19.051Z",
    "dateUpdated": "2026-10-13T18:16:26.644Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-109711 (GCVE-0-2026-109711)

Vulnerability from cvelistv5 – Published: 2026-10-13 12:29 – Updated: 2026-10-13 18:16

Title

Use-after-free in the Graphics: Canvas2D component

Summary

Use-after-free in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.

Severity

5.4 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-13 14:13 UTC

CWE

CWE-416 - Use After Free

Assigner

mozilla CNA under the mitre root

CNA scorecard E 38/100 over 546 records in the last 180 days details

References

5 references

URL	Tags
https://bugzilla.mozilla.org/show_bug.cgi?id=2068344
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…

Impacted products

2 products

Vendor	Product	Version
Mozilla	Firefox	Unaffected: 153.5 , ≤ 153.* (rpm) Unaffected: 158 , ≤ * (rpm)
Mozilla	Thunderbird	Unaffected: 153.5 , ≤ 153.* (rpm) Unaffected: 158 , ≤ * (rpm)

Credits

Mozilla

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 5.4,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "LOW",
              "integrityImpact": "LOW",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-109711",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-13T14:13:25.574620Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-416",
                "description": "CWE-416 Use After Free",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-13T14:18:50.517Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Firefox",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "153.*",
              "status": "unaffected",
              "version": "153.5",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "158",
              "versionType": "rpm"
            }
          ]
        },
        {
          "product": "Thunderbird",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "153.*",
              "status": "unaffected",
              "version": "153.5",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "158",
              "versionType": "rpm"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Mozilla"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Use-after-free in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5."
            }
          ],
          "value": "Use-after-free in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-13T18:16:50.976Z",
        "orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
        "shortName": "mozilla"
      },
      "references": [
        {
          "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2068344"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-106/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-108/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-109/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-110/"
        }
      ],
      "title": "Use-after-free in the Graphics: Canvas2D component"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
    "assignerShortName": "mozilla",
    "cveId": "CVE-2026-109711",
    "datePublished": "2026-10-13T12:29:22.742Z",
    "dateReserved": "2026-10-13T00:29:19.916Z",
    "dateUpdated": "2026-10-13T18:16:50.976Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-109712 (GCVE-0-2026-109712)

Vulnerability from cvelistv5 – Published: 2026-10-13 12:29 – Updated: 2026-10-13 18:16

Title

Sandbox escape due to uninitialized memory in the Graphics component

Summary

Sandbox escape due to uninitialized memory in the Graphics component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.

Severity

No CVSS data available.

Assigner

mozilla CNA under the mitre root

CNA scorecard E 38/100 over 546 records in the last 180 days details

References

6 references

URL	Tags
https://bugzilla.mozilla.org/show_bug.cgi?id=2068420
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…

Impacted products

2 products

Vendor	Product	Version
Mozilla	Firefox	Unaffected: 115.43 , ≤ 115.* (rpm) Unaffected: 153.5 , ≤ 153.* (rpm) Unaffected: 158 , ≤ * (rpm)
Mozilla	Thunderbird	Unaffected: 153.5 , ≤ 153.* (rpm) Unaffected: 158 , ≤ * (rpm)

Credits

Mozilla

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "Firefox",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "115.*",
              "status": "unaffected",
              "version": "115.43",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "153.*",
              "status": "unaffected",
              "version": "153.5",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "158",
              "versionType": "rpm"
            }
          ]
        },
        {
          "product": "Thunderbird",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "153.*",
              "status": "unaffected",
              "version": "153.5",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "158",
              "versionType": "rpm"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Mozilla"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Sandbox escape due to uninitialized memory in the Graphics component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5."
            }
          ],
          "value": "Sandbox escape due to uninitialized memory in the Graphics component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-13T18:16:27.718Z",
        "orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
        "shortName": "mozilla"
      },
      "references": [
        {
          "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2068420"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-106/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-107/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-108/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-109/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-110/"
        }
      ],
      "title": "Sandbox escape due to uninitialized memory in the Graphics component"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
    "assignerShortName": "mozilla",
    "cveId": "CVE-2026-109712",
    "datePublished": "2026-10-13T12:29:18.170Z",
    "dateReserved": "2026-10-13T00:29:20.766Z",
    "dateUpdated": "2026-10-13T18:16:27.718Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CERTFR-2026-AVI-1305

Solutions

CVE-2026-106016 (GCVE-0-2026-106016)

CVE-2026-109704 (GCVE-0-2026-109704)

CVE-2026-109705 (GCVE-0-2026-109705)

CVE-2026-109706 (GCVE-0-2026-109706)

CVE-2026-109707 (GCVE-0-2026-109707)

CVE-2026-109708 (GCVE-0-2026-109708)

CVE-2026-109709 (GCVE-0-2026-109709)

CVE-2026-109710 (GCVE-0-2026-109710)

CVE-2026-109711 (GCVE-0-2026-109711)

CVE-2026-109712 (GCVE-0-2026-109712)

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour