Search

Find a vulnerability

Search criteria ⓘ Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.

    7490 vulnerabilities found for Firefox by Mozilla

    CERTFR-2026-AVI-1305

    Vulnerability from certfr_avis - Published: 2026-10-14 - Updated: 2026-10-14

    De multiples vulnérabilités ont été découvertes dans les produits Mozilla. Certaines d'entre elles permettent à un attaquant de provoquer une élévation de privilèges, un déni de service à distance et une atteinte à la confidentialité des données.

    Solutions

    Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

    Impacted products
    Vendor Product Description
    Mozilla Firefox Firefox versions antérieures à 158
    Mozilla Firefox ESR Firefox ESR versions antérieures à 115.43
    Mozilla Thunderbird Thunderbird versions antérieures à 153.5
    Mozilla Thunderbird Thunderbird versions antérieures à 158
    Mozilla Firefox ESR Firefox ESR versions antérieures à 153.5
    References

    Show details on source website
    To clipboard 

    {
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Firefox versions ant\u00e9rieures \u00e0 158",
      "product": {
        "name": "Firefox",
        "vendor": {
          "name": "Mozilla",
          "scada": false
        }
      }
    },
    {
      "description": "Firefox ESR versions ant\u00e9rieures \u00e0 115.43",
      "product": {
        "name": "Firefox ESR",
        "vendor": {
          "name": "Mozilla",
          "scada": false
        }
      }
    },
    {
      "description": "Thunderbird versions ant\u00e9rieures \u00e0 153.5",
      "product": {
        "name": "Thunderbird",
        "vendor": {
          "name": "Mozilla",
          "scada": false
        }
      }
    },
    {
      "description": "Thunderbird versions ant\u00e9rieures \u00e0 158",
      "product": {
        "name": "Thunderbird",
        "vendor": {
          "name": "Mozilla",
          "scada": false
        }
      }
    },
    {
      "description": "Firefox ESR versions ant\u00e9rieures \u00e0 153.5",
      "product": {
        "name": "Firefox ESR",
        "vendor": {
          "name": "Mozilla",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": "",
  "content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
  "cves": [
    {
      "name": "CVE-2026-109779",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109779"
    },
    {
      "name": "CVE-2026-109710",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109710"
    },
    {
      "name": "CVE-2026-109719",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109719"
    },
    {
      "name": "CVE-2026-109735",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109735"
    },
    {
      "name": "CVE-2026-109730",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109730"
    },
    {
      "name": "CVE-2026-109721",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109721"
    },
    {
      "name": "CVE-2026-109715",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109715"
    },
    {
      "name": "CVE-2026-109727",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109727"
    },
    {
      "name": "CVE-2026-109775",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109775"
    },
    {
      "name": "CVE-2026-109717",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109717"
    },
    {
      "name": "CVE-2026-109761",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109761"
    },
    {
      "name": "CVE-2026-109772",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109772"
    },
    {
      "name": "CVE-2026-109746",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109746"
    },
    {
      "name": "CVE-2026-109774",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109774"
    },
    {
      "name": "CVE-2026-109723",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109723"
    },
    {
      "name": "CVE-2026-109749",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109749"
    },
    {
      "name": "CVE-2026-109764",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109764"
    },
    {
      "name": "CVE-2026-109753",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109753"
    },
    {
      "name": "CVE-2026-109751",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109751"
    },
    {
      "name": "CVE-2026-109781",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109781"
    },
    {
      "name": "CVE-2026-109736",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109736"
    },
    {
      "name": "CVE-2026-109750",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109750"
    },
    {
      "name": "CVE-2026-109707",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109707"
    },
    {
      "name": "CVE-2026-109706",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109706"
    },
    {
      "name": "CVE-2026-109713",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109713"
    },
    {
      "name": "CVE-2026-109720",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109720"
    },
    {
      "name": "CVE-2026-109708",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109708"
    },
    {
      "name": "CVE-2026-109728",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109728"
    },
    {
      "name": "CVE-2026-110247",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-110247"
    },
    {
      "name": "CVE-2026-109748",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109748"
    },
    {
      "name": "CVE-2026-109732",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109732"
    },
    {
      "name": "CVE-2026-109741",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109741"
    },
    {
      "name": "CVE-2026-109729",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109729"
    },
    {
      "name": "CVE-2026-109722",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109722"
    },
    {
      "name": "CVE-2026-109783",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109783"
    },
    {
      "name": "CVE-2026-109754",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109754"
    },
    {
      "name": "CVE-2026-109759",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109759"
    },
    {
      "name": "CVE-2026-109773",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109773"
    },
    {
      "name": "CVE-2026-109711",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109711"
    },
    {
      "name": "CVE-2026-109770",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109770"
    },
    {
      "name": "CVE-2026-109704",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109704"
    },
    {
      "name": "CVE-2026-109724",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109724"
    },
    {
      "name": "CVE-2026-109714",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109714"
    },
    {
      "name": "CVE-2026-109771",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109771"
    },
    {
      "name": "CVE-2026-109765",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109765"
    },
    {
      "name": "CVE-2026-109726",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109726"
    },
    {
      "name": "CVE-2026-109716",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109716"
    },
    {
      "name": "CVE-2026-109705",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109705"
    },
    {
      "name": "CVE-2026-109767",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109767"
    },
    {
      "name": "CVE-2026-109734",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109734"
    },
    {
      "name": "CVE-2026-109733",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109733"
    },
    {
      "name": "CVE-2026-109778",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109778"
    },
    {
      "name": "CVE-2026-109782",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109782"
    },
    {
      "name": "CVE-2026-109757",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109757"
    },
    {
      "name": "CVE-2026-109756",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109756"
    },
    {
      "name": "CVE-2026-109769",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109769"
    },
    {
      "name": "CVE-2026-109709",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109709"
    },
    {
      "name": "CVE-2026-109725",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109725"
    },
    {
      "name": "CVE-2026-109766",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109766"
    },
    {
      "name": "CVE-2026-109763",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109763"
    },
    {
      "name": "CVE-2026-106016",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-106016"
    },
    {
      "name": "CVE-2026-109742",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109742"
    },
    {
      "name": "CVE-2026-109743",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109743"
    },
    {
      "name": "CVE-2026-109740",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109740"
    },
    {
      "name": "CVE-2026-110249",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-110249"
    },
    {
      "name": "CVE-2026-109755",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109755"
    },
    {
      "name": "CVE-2026-109780",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109780"
    },
    {
      "name": "CVE-2026-109762",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109762"
    },
    {
      "name": "CVE-2026-109760",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109760"
    },
    {
      "name": "CVE-2026-109744",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109744"
    },
    {
      "name": "CVE-2026-109747",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109747"
    },
    {
      "name": "CVE-2026-109737",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109737"
    },
    {
      "name": "CVE-2026-109752",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109752"
    },
    {
      "name": "CVE-2026-109776",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109776"
    },
    {
      "name": "CVE-2026-109745",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109745"
    },
    {
      "name": "CVE-2026-109768",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109768"
    },
    {
      "name": "CVE-2026-109712",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109712"
    },
    {
      "name": "CVE-2026-109777",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109777"
    },
    {
      "name": "CVE-2026-109718",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109718"
    },
    {
      "name": "CVE-2026-109731",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109731"
    },
    {
      "name": "CVE-2026-109739",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109739"
    },
    {
      "name": "CVE-2026-109738",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109738"
    }
  ],
  "initial_release_date": "2026-10-14T00:00:00",
  "last_revision_date": "2026-10-14T00:00:00",
  "links": [],
  "reference": "CERTFR-2026-AVI-1305",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2026-10-14T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "D\u00e9ni de service \u00e0 distance"
    },
    {
      "description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
    },
    {
      "description": "Non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur"
    },
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    },
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    },
    {
      "description": "\u00c9l\u00e9vation de privil\u00e8ges"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits Mozilla. Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer une \u00e9l\u00e9vation de privil\u00e8ges, un d\u00e9ni de service \u00e0 distance et une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es.",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Mozilla",
  "vendor_advisories": [
    {
      "published_at": "2026-10-13",
      "title": "Bulletin de s\u00e9curit\u00e9 Mozilla mfsa2026-107",
      "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2026-107/"
    },
    {
      "published_at": "2026-10-13",
      "title": "Bulletin de s\u00e9curit\u00e9 Mozilla mfsa2026-106",
      "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2026-106/"
    },
    {
      "published_at": "2026-10-13",
      "title": "Bulletin de s\u00e9curit\u00e9 Mozilla mfsa2026-109",
      "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2026-109/"
    },
    {
      "published_at": "2026-10-13",
      "title": "Bulletin de s\u00e9curit\u00e9 Mozilla mfsa2026-110",
      "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2026-110/"
    },
    {
      "published_at": "2026-10-13",
      "title": "Bulletin de s\u00e9curit\u00e9 Mozilla mfsa2026-108",
      "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2026-108/"
    }
  ]
}

    CVE-2026-109783 (GCVE-0-2026-109783)

    Vulnerability from nvd – Published: 2026-10-13 12:29 – Updated: 2026-10-13 18:17
    VLAI
    Title
    Mitigation bypass in the File Handling component
    Summary
    Mitigation bypass in the File Handling component. This vulnerability was fixed in Firefox ESR 153.5 and Thunderbird 153.5.
    Severity
    No CVSS data available.
    Assigner
    mozilla CNA under the mitre root
    CNA scorecard E 38/100 over 546 records in the last 180 days details
    References
    Impacted products
    Vendor Product Version
    Mozilla Firefox Unaffected: 153.5 , ≤ * (rpm)
    		Create a notification for this product.
    Mozilla Thunderbird Unaffected: 153.5 , ≤ * (rpm)
    		Create a notification for this product.
    Credits
    Mozilla
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "Firefox",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "153.5",
              "versionType": "rpm"
            }
          ]
        },
        {
          "product": "Thunderbird",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "153.5",
              "versionType": "rpm"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Mozilla"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Mitigation bypass in the File Handling component. This vulnerability was fixed in Firefox ESR 153.5 and Thunderbird 153.5."
            }
          ],
          "value": "Mitigation bypass in the File Handling component. This vulnerability was fixed in Firefox ESR 153.5 and Thunderbird 153.5."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-13T18:17:24.062Z",
        "orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
        "shortName": "mozilla"
      },
      "references": [
        {
          "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2075533"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-108/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-110/"
        }
      ],
      "title": "Mitigation bypass in the File Handling component"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
    "assignerShortName": "mozilla",
    "cveId": "CVE-2026-109783",
    "datePublished": "2026-10-13T12:29:36.256Z",
    "dateReserved": "2026-10-13T00:49:22.774Z",
    "dateUpdated": "2026-10-13T18:17:24.062Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-109782 (GCVE-0-2026-109782)

    Vulnerability from nvd – Published: 2026-10-13 12:29 – Updated: 2026-10-13 18:17
    VLAI
    Title
    Mitigation bypass in the File Handling component
    Summary
    Mitigation bypass in the File Handling component. This vulnerability was fixed in Firefox ESR 153.5 and Thunderbird 153.5.
    Severity
    No CVSS data available.
    Assigner
    mozilla CNA under the mitre root
    CNA scorecard E 38/100 over 546 records in the last 180 days details
    References
    Impacted products
    Vendor Product Version
    Mozilla Firefox Unaffected: 153.5 , ≤ * (rpm)
    		Create a notification for this product.
    Mozilla Thunderbird Unaffected: 153.5 , ≤ * (rpm)
    		Create a notification for this product.
    Credits
    Abdulrahman Alzahrani
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "Firefox",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "153.5",
              "versionType": "rpm"
            }
          ]
        },
        {
          "product": "Thunderbird",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "153.5",
              "versionType": "rpm"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Abdulrahman Alzahrani"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Mitigation bypass in the File Handling component. This vulnerability was fixed in Firefox ESR 153.5 and Thunderbird 153.5."
            }
          ],
          "value": "Mitigation bypass in the File Handling component. This vulnerability was fixed in Firefox ESR 153.5 and Thunderbird 153.5."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-13T18:17:09.475Z",
        "orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
        "shortName": "mozilla"
      },
      "references": [
        {
          "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2067465"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-108/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-110/"
        }
      ],
      "title": "Mitigation bypass in the File Handling component"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
    "assignerShortName": "mozilla",
    "cveId": "CVE-2026-109782",
    "datePublished": "2026-10-13T12:29:36.025Z",
    "dateReserved": "2026-10-13T00:49:20.493Z",
    "dateUpdated": "2026-10-13T18:17:09.475Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-109781 (GCVE-0-2026-109781)

    Vulnerability from nvd – Published: 2026-10-13 12:29 – Updated: 2026-10-13 18:17
    VLAI
    Title
    Denial-of-service in the Printing: Output component
    Summary
    Denial-of-service in the Printing: Output component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.
    Severity
    6.5 (Medium)
    CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
    SSVC
    Exploitation: none Automatable: no Technical Impact: partial
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-10-13 14:21 UTC
    CWE
    • CWE-400 - Uncontrolled Resource Consumption
    Assigner
    mozilla CNA under the mitre root
    CNA scorecard E 38/100 over 546 records in the last 180 days details
    References
    Impacted products
    Vendor Product Version
    Mozilla Firefox Unaffected: 153.5 , ≤ 153.* (rpm)
    Unaffected: 158 , ≤ * (rpm)
    		Create a notification for this product.
    Mozilla Thunderbird Unaffected: 153.5 , ≤ 153.* (rpm)
    Unaffected: 158 , ≤ * (rpm)
    		Create a notification for this product.
    Credits
    Nguyen Thanh Nguyen
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 6.5,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-109781",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-13T14:21:45.441870Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-400",
                "description": "CWE-400 Uncontrolled Resource Consumption",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-13T14:21:50.891Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Firefox",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "153.*",
              "status": "unaffected",
              "version": "153.5",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "158",
              "versionType": "rpm"
            }
          ]
        },
        {
          "product": "Thunderbird",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "153.*",
              "status": "unaffected",
              "version": "153.5",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "158",
              "versionType": "rpm"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Nguyen Thanh Nguyen"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Denial-of-service in the Printing: Output component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5."
            }
          ],
          "value": "Denial-of-service in the Printing: Output component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-13T18:17:30.187Z",
        "orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
        "shortName": "mozilla"
      },
      "references": [
        {
          "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2072852"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-106/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-108/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-109/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-110/"
        }
      ],
      "title": "Denial-of-service in the Printing: Output component"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
    "assignerShortName": "mozilla",
    "cveId": "CVE-2026-109781",
    "datePublished": "2026-10-13T12:29:35.824Z",
    "dateReserved": "2026-10-13T00:49:18.273Z",
    "dateUpdated": "2026-10-13T18:17:30.187Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-109780 (GCVE-0-2026-109780)

    Vulnerability from nvd – Published: 2026-10-13 12:29 – Updated: 2026-10-13 18:08
    VLAI
    Title
    Mitigation bypass in the DOM: Core & HTML component
    Summary
    Mitigation bypass in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 158 and Thunderbird 158.
    Severity
    No CVSS data available.
    Assigner
    mozilla CNA under the mitre root
    CNA scorecard E 38/100 over 546 records in the last 180 days details
    References
    Impacted products
    Vendor Product Version
    Mozilla Firefox Unaffected: 158 , ≤ * (rpm)
    		Create a notification for this product.
    Mozilla Thunderbird Unaffected: 158 , ≤ * (rpm)
    		Create a notification for this product.
    Credits
    Shannon Booth
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "Firefox",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "158",
              "versionType": "rpm"
            }
          ]
        },
        {
          "product": "Thunderbird",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "158",
              "versionType": "rpm"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Shannon Booth"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Mitigation bypass in the DOM: Core \u0026 HTML component. This vulnerability was fixed in Firefox 158 and Thunderbird 158."
            }
          ],
          "value": "Mitigation bypass in the DOM: Core \u0026 HTML component. This vulnerability was fixed in Firefox 158 and Thunderbird 158."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-13T18:08:36.500Z",
        "orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
        "shortName": "mozilla"
      },
      "references": [
        {
          "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2072775"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-106/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-109/"
        }
      ],
      "title": "Mitigation bypass in the DOM: Core \u0026 HTML component"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
    "assignerShortName": "mozilla",
    "cveId": "CVE-2026-109780",
    "datePublished": "2026-10-13T12:29:35.608Z",
    "dateReserved": "2026-10-13T00:49:15.410Z",
    "dateUpdated": "2026-10-13T18:08:36.500Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-109779 (GCVE-0-2026-109779)

    Vulnerability from nvd – Published: 2026-10-13 12:29 – Updated: 2026-10-13 18:08
    VLAI
    Title
    Race condition in the Networking: DNS component
    Summary
    Race condition in the Networking: DNS component. This vulnerability was fixed in Firefox 158 and Thunderbird 158.
    Severity
    4.2 (Medium)
    CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N
    SSVC
    Exploitation: none Automatable: no Technical Impact: partial
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-10-13 14:53 UTC
    CWE
    • CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
    Assigner
    mozilla CNA under the mitre root
    CNA scorecard E 38/100 over 546 records in the last 180 days details
    References
    Impacted products
    Vendor Product Version
    Mozilla Firefox Unaffected: 158 , ≤ * (rpm)
    		Create a notification for this product.
    Mozilla Thunderbird Unaffected: 158 , ≤ * (rpm)
    		Create a notification for this product.
    Credits
    Mozilla
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "HIGH",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 4.2,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "LOW",
              "integrityImpact": "LOW",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-109779",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-13T14:53:48.294735Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-362",
                "description": "CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027)",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-13T14:53:51.689Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Firefox",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "158",
              "versionType": "rpm"
            }
          ]
        },
        {
          "product": "Thunderbird",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "158",
              "versionType": "rpm"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Mozilla"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Race condition in the Networking: DNS component. This vulnerability was fixed in Firefox 158 and Thunderbird 158."
            }
          ],
          "value": "Race condition in the Networking: DNS component. This vulnerability was fixed in Firefox 158 and Thunderbird 158."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-13T18:08:35.924Z",
        "orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
        "shortName": "mozilla"
      },
      "references": [
        {
          "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2072048"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-106/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-109/"
        }
      ],
      "title": "Race condition in the Networking: DNS component"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
    "assignerShortName": "mozilla",
    "cveId": "CVE-2026-109779",
    "datePublished": "2026-10-13T12:29:35.359Z",
    "dateReserved": "2026-10-13T00:49:13.115Z",
    "dateUpdated": "2026-10-13T18:08:35.924Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-109778 (GCVE-0-2026-109778)

    Vulnerability from nvd – Published: 2026-10-13 12:29 – Updated: 2026-10-14 03:59
    VLAI
    Title
    Privilege escalation in the WebExtensions component
    Summary
    Privilege escalation in the WebExtensions component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.
    Severity
    8.8 (High)
    CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
    SSVC
    Exploitation: none Automatable: no Technical Impact: total
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-10-13 00:00 UTC
    CWE
    • CWE-269 - Improper Privilege Management
    Assigner
    mozilla CNA under the mitre root
    CNA scorecard E 38/100 over 546 records in the last 180 days details
    References
    Impacted products
    Vendor Product Version
    Mozilla Firefox Unaffected: 153.5 , ≤ 153.* (rpm)
    Unaffected: 158 , ≤ * (rpm)
    		Create a notification for this product.
    Mozilla Thunderbird Unaffected: 153.5 , ≤ 153.* (rpm)
    Unaffected: 158 , ≤ * (rpm)
    		Create a notification for this product.
    Credits
    Mozilla
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 8.8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-109778",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-13T00:00:00+00:00",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-269",
                "description": "CWE-269 Improper Privilege Management",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-14T03:59:03.757Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Firefox",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "153.*",
              "status": "unaffected",
              "version": "153.5",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "158",
              "versionType": "rpm"
            }
          ]
        },
        {
          "product": "Thunderbird",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "153.*",
              "status": "unaffected",
              "version": "153.5",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "158",
              "versionType": "rpm"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Mozilla"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Privilege escalation in the WebExtensions component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5."
            }
          ],
          "value": "Privilege escalation in the WebExtensions component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-13T18:17:29.200Z",
        "orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
        "shortName": "mozilla"
      },
      "references": [
        {
          "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2070547"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-106/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-108/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-109/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-110/"
        }
      ],
      "title": "Privilege escalation in the WebExtensions component"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
    "assignerShortName": "mozilla",
    "cveId": "CVE-2026-109778",
    "datePublished": "2026-10-13T12:29:35.148Z",
    "dateReserved": "2026-10-13T00:49:10.870Z",
    "dateUpdated": "2026-10-14T03:59:03.757Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-109777 (GCVE-0-2026-109777)

    Vulnerability from nvd – Published: 2026-10-13 12:29 – Updated: 2026-10-13 18:17
    VLAI
    Title
    Information disclosure in the Storage: IndexedDB component
    Summary
    Information disclosure in the Storage: IndexedDB component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.
    Severity
    4.3 (Medium)
    CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
    SSVC
    Exploitation: none Automatable: no Technical Impact: partial
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-10-13 14:56 UTC
    CWE
    • CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor
    Assigner
    mozilla CNA under the mitre root
    CNA scorecard E 38/100 over 546 records in the last 180 days details
    References
    Impacted products
    Vendor Product Version
    Mozilla Firefox Unaffected: 153.5 , ≤ 153.* (rpm)
    Unaffected: 158 , ≤ * (rpm)
    		Create a notification for this product.
    Mozilla Thunderbird Unaffected: 153.5 , ≤ 153.* (rpm)
    Unaffected: 158 , ≤ * (rpm)
    		Create a notification for this product.
    Credits
    Shu Takahashi of Velcore Consulting Inc.
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 4.3,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "LOW",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-109777",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-13T14:56:02.265281Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-200",
                "description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-13T14:56:28.692Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Firefox",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "153.*",
              "status": "unaffected",
              "version": "153.5",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "158",
              "versionType": "rpm"
            }
          ]
        },
        {
          "product": "Thunderbird",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "153.*",
              "status": "unaffected",
              "version": "153.5",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "158",
              "versionType": "rpm"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Shu Takahashi  of Velcore Consulting Inc."
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Information disclosure in the Storage: IndexedDB component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5."
            }
          ],
          "value": "Information disclosure in the Storage: IndexedDB component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-13T18:17:28.186Z",
        "orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
        "shortName": "mozilla"
      },
      "references": [
        {
          "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2069638"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-106/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-108/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-109/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-110/"
        }
      ],
      "title": "Information disclosure in the Storage: IndexedDB component"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
    "assignerShortName": "mozilla",
    "cveId": "CVE-2026-109777",
    "datePublished": "2026-10-13T12:29:34.941Z",
    "dateReserved": "2026-10-13T00:49:08.777Z",
    "dateUpdated": "2026-10-13T18:17:28.186Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-109776 (GCVE-0-2026-109776)

    Vulnerability from nvd – Published: 2026-10-13 12:29 – Updated: 2026-10-13 18:17
    VLAI
    Title
    Race condition in the XPCOM component
    Summary
    Race condition in the XPCOM component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.
    Severity
    No CVSS data available.
    Assigner
    mozilla CNA under the mitre root
    CNA scorecard E 38/100 over 546 records in the last 180 days details
    References
    Impacted products
    Vendor Product Version
    Mozilla Firefox Unaffected: 153.5 , ≤ 153.* (rpm)
    Unaffected: 158 , ≤ * (rpm)
    		Create a notification for this product.
    Mozilla Thunderbird Unaffected: 153.5 , ≤ 153.* (rpm)
    Unaffected: 158 , ≤ * (rpm)
    		Create a notification for this product.
    Credits
    Mozilla
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "Firefox",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "153.*",
              "status": "unaffected",
              "version": "153.5",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "158",
              "versionType": "rpm"
            }
          ]
        },
        {
          "product": "Thunderbird",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "153.*",
              "status": "unaffected",
              "version": "153.5",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "158",
              "versionType": "rpm"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Mozilla"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Race condition in the XPCOM component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5."
            }
          ],
          "value": "Race condition in the XPCOM component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-13T18:17:27.136Z",
        "orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
        "shortName": "mozilla"
      },
      "references": [
        {
          "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2069395"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-106/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-108/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-109/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-110/"
        }
      ],
      "title": "Race condition in the XPCOM component"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
    "assignerShortName": "mozilla",
    "cveId": "CVE-2026-109776",
    "datePublished": "2026-10-13T12:29:34.739Z",
    "dateReserved": "2026-10-13T00:49:06.510Z",
    "dateUpdated": "2026-10-13T18:17:27.136Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-109775 (GCVE-0-2026-109775)

    Vulnerability from nvd – Published: 2026-10-13 12:29 – Updated: 2026-10-13 18:17
    VLAI
    Title
    Denial-of-service in the WebRTC component
    Summary
    Denial-of-service in the WebRTC component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.
    Severity
    6.5 (Medium)
    CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
    SSVC
    Exploitation: none Automatable: no Technical Impact: partial
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-10-13 14:07 UTC
    CWE
    • CWE-400 - Uncontrolled Resource Consumption
    Assigner
    mozilla CNA under the mitre root
    CNA scorecard E 38/100 over 546 records in the last 180 days details
    References
    Impacted products
    Vendor Product Version
    Mozilla Firefox Unaffected: 153.5 , ≤ 153.* (rpm)
    Unaffected: 158 , ≤ * (rpm)
    		Create a notification for this product.
    Mozilla Thunderbird Unaffected: 153.5 , ≤ 153.* (rpm)
    Unaffected: 158 , ≤ * (rpm)
    		Create a notification for this product.
    Credits
    Shu Takahashi of Velcore Consulting Inc.
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 6.5,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-109775",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-13T14:07:02.871265Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-400",
                "description": "CWE-400 Uncontrolled Resource Consumption",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-13T14:07:07.647Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Firefox",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "153.*",
              "status": "unaffected",
              "version": "153.5",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "158",
              "versionType": "rpm"
            }
          ]
        },
        {
          "product": "Thunderbird",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "153.*",
              "status": "unaffected",
              "version": "153.5",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "158",
              "versionType": "rpm"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Shu Takahashi  of Velcore Consulting Inc."
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Denial-of-service in the WebRTC component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5."
            }
          ],
          "value": "Denial-of-service in the WebRTC component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-13T18:17:26.133Z",
        "orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
        "shortName": "mozilla"
      },
      "references": [
        {
          "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2068255"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-106/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-108/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-109/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-110/"
        }
      ],
      "title": "Denial-of-service in the WebRTC component"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
    "assignerShortName": "mozilla",
    "cveId": "CVE-2026-109775",
    "datePublished": "2026-10-13T12:29:34.538Z",
    "dateReserved": "2026-10-13T00:49:03.832Z",
    "dateUpdated": "2026-10-13T18:17:26.133Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-109774 (GCVE-0-2026-109774)

    Vulnerability from nvd – Published: 2026-10-13 12:29 – Updated: 2026-10-13 18:08
    VLAI
    Title
    Invalid pointer, undefined behavior in the DOM: Notifications component
    Summary
    Invalid pointer, undefined behavior in the DOM: Notifications component. This vulnerability was fixed in Firefox 158 and Thunderbird 158.
    Severity
    No CVSS data available.
    Assigner
    mozilla CNA under the mitre root
    CNA scorecard E 38/100 over 546 records in the last 180 days details
    References
    Impacted products
    Vendor Product Version
    Mozilla Firefox Unaffected: 158 , ≤ * (rpm)
    		Create a notification for this product.
    Mozilla Thunderbird Unaffected: 158 , ≤ * (rpm)
    		Create a notification for this product.
    Credits
    zx
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "Firefox",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "158",
              "versionType": "rpm"
            }
          ]
        },
        {
          "product": "Thunderbird",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "158",
              "versionType": "rpm"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "zx"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Invalid pointer, undefined behavior in the DOM: Notifications component. This vulnerability was fixed in Firefox 158 and Thunderbird 158."
            }
          ],
          "value": "Invalid pointer, undefined behavior in the DOM: Notifications component. This vulnerability was fixed in Firefox 158 and Thunderbird 158."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-13T18:08:33.321Z",
        "orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
        "shortName": "mozilla"
      },
      "references": [
        {
          "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2067657"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-106/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-109/"
        }
      ],
      "title": "Invalid pointer, undefined behavior in the DOM: Notifications component"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
    "assignerShortName": "mozilla",
    "cveId": "CVE-2026-109774",
    "datePublished": "2026-10-13T12:29:34.325Z",
    "dateReserved": "2026-10-13T00:49:00.780Z",
    "dateUpdated": "2026-10-13T18:08:33.321Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-109773 (GCVE-0-2026-109773)

    Vulnerability from nvd – Published: 2026-10-13 12:29 – Updated: 2026-10-13 18:08
    VLAI
    Title
    Denial-of-service in the Sync component
    Summary
    Denial-of-service in the Sync component. This vulnerability was fixed in Firefox 158 and Thunderbird 158.
    Severity
    6.5 (Medium)
    CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
    SSVC
    Exploitation: none Automatable: no Technical Impact: partial
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-10-13 14:54 UTC
    CWE
    • CWE-400 - Uncontrolled Resource Consumption
    Assigner
    mozilla CNA under the mitre root
    CNA scorecard E 38/100 over 546 records in the last 180 days details
    References
    Impacted products
    Vendor Product Version
    Mozilla Firefox Unaffected: 158 , ≤ * (rpm)
    		Create a notification for this product.
    Mozilla Thunderbird Unaffected: 158 , ≤ * (rpm)
    		Create a notification for this product.
    Credits
    Bruno
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 6.5,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-109773",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-13T14:54:07.887501Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-400",
                "description": "CWE-400 Uncontrolled Resource Consumption",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-13T14:54:45.740Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Firefox",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "158",
              "versionType": "rpm"
            }
          ]
        },
        {
          "product": "Thunderbird",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "158",
              "versionType": "rpm"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Bruno"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Denial-of-service in the Sync component. This vulnerability was fixed in Firefox 158 and Thunderbird 158."
            }
          ],
          "value": "Denial-of-service in the Sync component. This vulnerability was fixed in Firefox 158 and Thunderbird 158."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-13T18:08:32.778Z",
        "orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
        "shortName": "mozilla"
      },
      "references": [
        {
          "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2066094"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-106/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-109/"
        }
      ],
      "title": "Denial-of-service in the Sync component"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
    "assignerShortName": "mozilla",
    "cveId": "CVE-2026-109773",
    "datePublished": "2026-10-13T12:29:34.116Z",
    "dateReserved": "2026-10-13T00:48:58.340Z",
    "dateUpdated": "2026-10-13T18:08:32.778Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-109772 (GCVE-0-2026-109772)

    Vulnerability from nvd – Published: 2026-10-13 12:29 – Updated: 2026-10-13 18:08
    VLAI
    Title
    Same-origin policy bypass in the DevTools component
    Summary
    Same-origin policy bypass in the DevTools component. This vulnerability was fixed in Firefox 158 and Thunderbird 158.
    Severity
    No CVSS data available.
    Assigner
    mozilla CNA under the mitre root
    CNA scorecard E 38/100 over 546 records in the last 180 days details
    References
    Impacted products
    Vendor Product Version
    Mozilla Firefox Unaffected: 158 , ≤ * (rpm)
    		Create a notification for this product.
    Mozilla Thunderbird Unaffected: 158 , ≤ * (rpm)
    		Create a notification for this product.
    Credits
    Finn Westendorf
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "Firefox",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "158",
              "versionType": "rpm"
            }
          ]
        },
        {
          "product": "Thunderbird",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "158",
              "versionType": "rpm"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Finn Westendorf"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Same-origin policy bypass in the DevTools component. This vulnerability was fixed in Firefox 158 and Thunderbird 158."
            }
          ],
          "value": "Same-origin policy bypass in the DevTools component. This vulnerability was fixed in Firefox 158 and Thunderbird 158."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-13T18:08:32.263Z",
        "orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
        "shortName": "mozilla"
      },
      "references": [
        {
          "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2066063"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-106/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-109/"
        }
      ],
      "title": "Same-origin policy bypass in the DevTools component"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
    "assignerShortName": "mozilla",
    "cveId": "CVE-2026-109772",
    "datePublished": "2026-10-13T12:29:33.912Z",
    "dateReserved": "2026-10-13T00:48:55.791Z",
    "dateUpdated": "2026-10-13T18:08:32.263Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-109771 (GCVE-0-2026-109771)

    Vulnerability from nvd – Published: 2026-10-13 12:29 – Updated: 2026-10-13 18:08
    VLAI
    Title
    Information disclosure in the WebRTC: Networking component
    Summary
    Information disclosure in the WebRTC: Networking component. This vulnerability was fixed in Firefox 158 and Thunderbird 158.
    Severity
    4.3 (Medium)
    CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
    SSVC
    Exploitation: none Automatable: no Technical Impact: partial
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-10-13 14:57 UTC
    CWE
    • CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor
    Assigner
    mozilla CNA under the mitre root
    CNA scorecard E 38/100 over 546 records in the last 180 days details
    References
    Impacted products
    Vendor Product Version
    Mozilla Firefox Unaffected: 158 , ≤ * (rpm)
    		Create a notification for this product.
    Mozilla Thunderbird Unaffected: 158 , ≤ * (rpm)
    		Create a notification for this product.
    Credits
    5up3rh3i
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 4.3,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "LOW",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-109771",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-13T14:57:45.540012Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-200",
                "description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-13T15:49:45.796Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Firefox",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "158",
              "versionType": "rpm"
            }
          ]
        },
        {
          "product": "Thunderbird",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "158",
              "versionType": "rpm"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "5up3rh3i"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Information disclosure in the WebRTC: Networking component. This vulnerability was fixed in Firefox 158 and Thunderbird 158."
            }
          ],
          "value": "Information disclosure in the WebRTC: Networking component. This vulnerability was fixed in Firefox 158 and Thunderbird 158."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-13T18:08:31.713Z",
        "orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
        "shortName": "mozilla"
      },
      "references": [
        {
          "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2059658"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-106/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-109/"
        }
      ],
      "title": "Information disclosure in the WebRTC: Networking component"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
    "assignerShortName": "mozilla",
    "cveId": "CVE-2026-109771",
    "datePublished": "2026-10-13T12:29:33.709Z",
    "dateReserved": "2026-10-13T00:48:53.766Z",
    "dateUpdated": "2026-10-13T18:08:31.713Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-109770 (GCVE-0-2026-109770)

    Vulnerability from nvd – Published: 2026-10-13 12:29 – Updated: 2026-10-13 18:17
    VLAI
    Title
    Spoofing issue in the DOM: Web Serial component
    Summary
    Spoofing issue in the DOM: Web Serial component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.
    Severity
    No CVSS data available.
    Assigner
    mozilla CNA under the mitre root
    CNA scorecard E 38/100 over 546 records in the last 180 days details
    References
    Impacted products
    Vendor Product Version
    Mozilla Firefox Unaffected: 153.5 , ≤ 153.* (rpm)
    Unaffected: 158 , ≤ * (rpm)
    		Create a notification for this product.
    Mozilla Thunderbird Unaffected: 153.5 , ≤ 153.* (rpm)
    Unaffected: 158 , ≤ * (rpm)
    		Create a notification for this product.
    Credits
    Mozilla
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "Firefox",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "153.*",
              "status": "unaffected",
              "version": "153.5",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "158",
              "versionType": "rpm"
            }
          ]
        },
        {
          "product": "Thunderbird",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "153.*",
              "status": "unaffected",
              "version": "153.5",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "158",
              "versionType": "rpm"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Mozilla"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Spoofing issue in the DOM: Web Serial component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5."
            }
          ],
          "value": "Spoofing issue in the DOM: Web Serial component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-13T18:17:25.100Z",
        "orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
        "shortName": "mozilla"
      },
      "references": [
        {
          "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2059230"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-106/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-108/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-109/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-110/"
        }
      ],
      "title": "Spoofing issue in the DOM: Web Serial component"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
    "assignerShortName": "mozilla",
    "cveId": "CVE-2026-109770",
    "datePublished": "2026-10-13T12:29:33.501Z",
    "dateReserved": "2026-10-13T00:48:51.726Z",
    "dateUpdated": "2026-10-13T18:17:25.100Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-109769 (GCVE-0-2026-109769)

    Vulnerability from nvd – Published: 2026-10-13 12:29 – Updated: 2026-10-13 18:08
    VLAI
    Title
    Information disclosure in the Networking: Cache component
    Summary
    Information disclosure in the Networking: Cache component. This vulnerability was fixed in Firefox 158 and Thunderbird 158.
    Severity
    4.3 (Medium)
    CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
    SSVC
    Exploitation: none Automatable: no Technical Impact: partial
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-10-13 14:57 UTC
    CWE
    • CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor
    Assigner
    mozilla CNA under the mitre root
    CNA scorecard E 38/100 over 546 records in the last 180 days details
    References
    Impacted products
    Vendor Product Version
    Mozilla Firefox Unaffected: 158 , ≤ * (rpm)
    		Create a notification for this product.
    Mozilla Thunderbird Unaffected: 158 , ≤ * (rpm)
    		Create a notification for this product.
    Credits
    Mohamed Mbarek
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 4.3,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "LOW",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-109769",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-13T14:57:47.574880Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-200",
                "description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-13T15:49:45.921Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Firefox",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "158",
              "versionType": "rpm"
            }
          ]
        },
        {
          "product": "Thunderbird",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "158",
              "versionType": "rpm"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Mohamed Mbarek"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Information disclosure in the Networking: Cache component. This vulnerability was fixed in Firefox 158 and Thunderbird 158."
            }
          ],
          "value": "Information disclosure in the Networking: Cache component. This vulnerability was fixed in Firefox 158 and Thunderbird 158."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-13T18:08:30.641Z",
        "orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
        "shortName": "mozilla"
      },
      "references": [
        {
          "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2050313"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-106/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-109/"
        }
      ],
      "title": "Information disclosure in the Networking: Cache component"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
    "assignerShortName": "mozilla",
    "cveId": "CVE-2026-109769",
    "datePublished": "2026-10-13T12:29:33.287Z",
    "dateReserved": "2026-10-13T00:48:48.685Z",
    "dateUpdated": "2026-10-13T18:08:30.641Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-109768 (GCVE-0-2026-109768)

    Vulnerability from nvd – Published: 2026-10-13 12:29 – Updated: 2026-10-13 18:08
    VLAI
    Title
    Denial-of-service in the Site Reports component
    Summary
    Denial-of-service in the Site Reports component. This vulnerability was fixed in Firefox 158 and Thunderbird 158.
    Severity
    6.5 (Medium)
    CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
    SSVC
    Exploitation: none Automatable: no Technical Impact: partial
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-10-13 14:55 UTC
    CWE
    • CWE-400 - Uncontrolled Resource Consumption
    Assigner
    mozilla CNA under the mitre root
    CNA scorecard E 38/100 over 546 records in the last 180 days details
    References
    Impacted products
    Vendor Product Version
    Mozilla Firefox Unaffected: 158 , ≤ * (rpm)
    		Create a notification for this product.
    Mozilla Thunderbird Unaffected: 158 , ≤ * (rpm)
    		Create a notification for this product.
    Credits
    Mozilla
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 6.5,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-109768",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-13T14:55:00.564624Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-400",
                "description": "CWE-400 Uncontrolled Resource Consumption",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-13T14:55:25.222Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Firefox",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "158",
              "versionType": "rpm"
            }
          ]
        },
        {
          "product": "Thunderbird",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "158",
              "versionType": "rpm"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Mozilla"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Denial-of-service in the Site Reports component. This vulnerability was fixed in Firefox 158 and Thunderbird 158."
            }
          ],
          "value": "Denial-of-service in the Site Reports component. This vulnerability was fixed in Firefox 158 and Thunderbird 158."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-13T18:08:30.140Z",
        "orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
        "shortName": "mozilla"
      },
      "references": [
        {
          "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2011368"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-106/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-109/"
        }
      ],
      "title": "Denial-of-service in the Site Reports component"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
    "assignerShortName": "mozilla",
    "cveId": "CVE-2026-109768",
    "datePublished": "2026-10-13T12:29:33.064Z",
    "dateReserved": "2026-10-13T00:48:47.039Z",
    "dateUpdated": "2026-10-13T18:08:30.140Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-109767 (GCVE-0-2026-109767)

    Vulnerability from nvd – Published: 2026-10-13 12:29 – Updated: 2026-10-13 18:17
    VLAI
    Title
    Information disclosure in the Networking component
    Summary
    Information disclosure in the Networking component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.
    Severity
    4.3 (Medium)
    CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
    SSVC
    Exploitation: none Automatable: no Technical Impact: partial
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-10-13 14:57 UTC
    CWE
    • CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor
    Assigner
    mozilla CNA under the mitre root
    CNA scorecard E 38/100 over 546 records in the last 180 days details
    References
    Impacted products
    Vendor Product Version
    Mozilla Firefox Unaffected: 153.5 , ≤ 153.* (rpm)
    Unaffected: 158 , ≤ * (rpm)
    		Create a notification for this product.
    Mozilla Thunderbird Unaffected: 153.5 , ≤ 153.* (rpm)
    Unaffected: 158 , ≤ * (rpm)
    		Create a notification for this product.
    Credits
    Mozilla
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 4.3,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "LOW",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-109767",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-13T14:57:49.680431Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-200",
                "description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-13T15:49:46.052Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Firefox",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "153.*",
              "status": "unaffected",
              "version": "153.5",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "158",
              "versionType": "rpm"
            }
          ]
        },
        {
          "product": "Thunderbird",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "153.*",
              "status": "unaffected",
              "version": "153.5",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "158",
              "versionType": "rpm"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Mozilla"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Information disclosure in the Networking component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5."
            }
          ],
          "value": "Information disclosure in the Networking component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-13T18:17:23.031Z",
        "orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
        "shortName": "mozilla"
      },
      "references": [
        {
          "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2074963"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-106/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-108/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-109/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-110/"
        }
      ],
      "title": "Information disclosure in the Networking component"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
    "assignerShortName": "mozilla",
    "cveId": "CVE-2026-109767",
    "datePublished": "2026-10-13T12:29:32.848Z",
    "dateReserved": "2026-10-13T00:48:43.806Z",
    "dateUpdated": "2026-10-13T18:17:23.031Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-109766 (GCVE-0-2026-109766)

    Vulnerability from nvd – Published: 2026-10-13 12:29 – Updated: 2026-10-13 18:17
    VLAI
    Title
    Mitigation bypass in the Enterprise Policies component
    Summary
    Mitigation bypass in the Enterprise Policies component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.
    Severity
    No CVSS data available.
    Assigner
    mozilla CNA under the mitre root
    CNA scorecard E 38/100 over 546 records in the last 180 days details
    References
    Impacted products
    Vendor Product Version
    Mozilla Firefox Unaffected: 153.5 , ≤ 153.* (rpm)
    Unaffected: 158 , ≤ * (rpm)
    		Create a notification for this product.
    Mozilla Thunderbird Unaffected: 153.5 , ≤ 153.* (rpm)
    Unaffected: 158 , ≤ * (rpm)
    		Create a notification for this product.
    Credits
    Souma Ohsawa
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "Firefox",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "153.*",
              "status": "unaffected",
              "version": "153.5",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "158",
              "versionType": "rpm"
            }
          ]
        },
        {
          "product": "Thunderbird",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "153.*",
              "status": "unaffected",
              "version": "153.5",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "158",
              "versionType": "rpm"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Souma Ohsawa"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Mitigation bypass in the Enterprise Policies component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5."
            }
          ],
          "value": "Mitigation bypass in the Enterprise Policies component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-13T18:17:21.995Z",
        "orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
        "shortName": "mozilla"
      },
      "references": [
        {
          "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2074406"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-106/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-108/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-109/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-110/"
        }
      ],
      "title": "Mitigation bypass in the Enterprise Policies component"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
    "assignerShortName": "mozilla",
    "cveId": "CVE-2026-109766",
    "datePublished": "2026-10-13T12:29:32.635Z",
    "dateReserved": "2026-10-13T00:48:40.759Z",
    "dateUpdated": "2026-10-13T18:17:21.995Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-109765 (GCVE-0-2026-109765)

    Vulnerability from nvd – Published: 2026-10-13 12:29 – Updated: 2026-10-13 18:17
    VLAI
    Title
    Race condition, use-after-free in the Graphics: Text component
    Summary
    Race condition, use-after-free in the Graphics: Text component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.
    Severity
    4.2 (Medium)
    CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N
    SSVC
    Exploitation: none Automatable: no Technical Impact: partial
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-10-13 14:08 UTC
    CWE
    • CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
    • CWE-416 - Use After Free
    Assigner
    mozilla CNA under the mitre root
    CNA scorecard E 38/100 over 546 records in the last 180 days details
    References
    Impacted products
    Vendor Product Version
    Mozilla Firefox Unaffected: 153.5 , ≤ 153.* (rpm)
    Unaffected: 158 , ≤ * (rpm)
    		Create a notification for this product.
    Mozilla Thunderbird Unaffected: 153.5 , ≤ 153.* (rpm)
    Unaffected: 158 , ≤ * (rpm)
    		Create a notification for this product.
    Credits
    Shu Takahashi of Velcore Consulting Inc.
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "HIGH",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 4.2,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "LOW",
              "integrityImpact": "LOW",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-109765",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-13T14:08:55.001726Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-362",
                "description": "CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027)",
                "lang": "en",
                "type": "CWE"
              },
              {
                "cweId": "CWE-416",
                "description": "CWE-416 Use After Free",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-13T14:08:58.343Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Firefox",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "153.*",
              "status": "unaffected",
              "version": "153.5",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "158",
              "versionType": "rpm"
            }
          ]
        },
        {
          "product": "Thunderbird",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "153.*",
              "status": "unaffected",
              "version": "153.5",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "158",
              "versionType": "rpm"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Shu Takahashi  of Velcore Consulting Inc."
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Race condition, use-after-free in the Graphics: Text component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5."
            }
          ],
          "value": "Race condition, use-after-free in the Graphics: Text component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-13T18:17:20.940Z",
        "orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
        "shortName": "mozilla"
      },
      "references": [
        {
          "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2073396"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-106/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-108/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-109/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-110/"
        }
      ],
      "title": "Race condition, use-after-free in the Graphics: Text component"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
    "assignerShortName": "mozilla",
    "cveId": "CVE-2026-109765",
    "datePublished": "2026-10-13T12:29:32.427Z",
    "dateReserved": "2026-10-13T00:48:37.689Z",
    "dateUpdated": "2026-10-13T18:17:20.940Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-109764 (GCVE-0-2026-109764)

    Vulnerability from nvd – Published: 2026-10-13 12:29 – Updated: 2026-10-13 18:17
    VLAI
    Title
    Mitigation bypass in the Enterprise Policies component
    Summary
    Mitigation bypass in the Enterprise Policies component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.
    Severity
    No CVSS data available.
    Assigner
    mozilla CNA under the mitre root
    CNA scorecard E 38/100 over 546 records in the last 180 days details
    References
    Impacted products
    Vendor Product Version
    Mozilla Firefox Unaffected: 153.5 , ≤ 153.* (rpm)
    Unaffected: 158 , ≤ * (rpm)
    		Create a notification for this product.
    Mozilla Thunderbird Unaffected: 153.5 , ≤ 153.* (rpm)
    Unaffected: 158 , ≤ * (rpm)
    		Create a notification for this product.
    Credits
    HyeonSeung Kim
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "Firefox",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "153.*",
              "status": "unaffected",
              "version": "153.5",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "158",
              "versionType": "rpm"
            }
          ]
        },
        {
          "product": "Thunderbird",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "153.*",
              "status": "unaffected",
              "version": "153.5",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "158",
              "versionType": "rpm"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "HyeonSeung Kim"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Mitigation bypass in the Enterprise Policies component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5."
            }
          ],
          "value": "Mitigation bypass in the Enterprise Policies component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-13T18:17:19.874Z",
        "orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
        "shortName": "mozilla"
      },
      "references": [
        {
          "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2073382"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-106/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-108/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-109/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-110/"
        }
      ],
      "title": "Mitigation bypass in the Enterprise Policies component"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
    "assignerShortName": "mozilla",
    "cveId": "CVE-2026-109764",
    "datePublished": "2026-10-13T12:29:32.209Z",
    "dateReserved": "2026-10-13T00:48:35.246Z",
    "dateUpdated": "2026-10-13T18:17:19.874Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-109763 (GCVE-0-2026-109763)

    Vulnerability from nvd – Published: 2026-10-13 12:29 – Updated: 2026-10-13 18:17
    VLAI
    Title
    Mitigation bypass in the File Handling component
    Summary
    Mitigation bypass in the File Handling component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.
    Severity
    No CVSS data available.
    Assigner
    mozilla CNA under the mitre root
    CNA scorecard E 38/100 over 546 records in the last 180 days details
    References
    Impacted products
    Vendor Product Version
    Mozilla Firefox Unaffected: 153.5 , ≤ 153.* (rpm)
    Unaffected: 158 , ≤ * (rpm)
    		Create a notification for this product.
    Mozilla Thunderbird Unaffected: 153.5 , ≤ 153.* (rpm)
    Unaffected: 158 , ≤ * (rpm)
    		Create a notification for this product.
    Credits
    Riku Bamba
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "Firefox",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "153.*",
              "status": "unaffected",
              "version": "153.5",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "158",
              "versionType": "rpm"
            }
          ]
        },
        {
          "product": "Thunderbird",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "153.*",
              "status": "unaffected",
              "version": "153.5",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "158",
              "versionType": "rpm"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Riku Bamba"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Mitigation bypass in the File Handling component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5."
            }
          ],
          "value": "Mitigation bypass in the File Handling component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-13T18:17:18.830Z",
        "orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
        "shortName": "mozilla"
      },
      "references": [
        {
          "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2072501"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-106/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-108/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-109/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-110/"
        }
      ],
      "title": "Mitigation bypass in the File Handling component"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
    "assignerShortName": "mozilla",
    "cveId": "CVE-2026-109763",
    "datePublished": "2026-10-13T12:29:31.945Z",
    "dateReserved": "2026-10-13T00:48:32.559Z",
    "dateUpdated": "2026-10-13T18:17:18.830Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-109762 (GCVE-0-2026-109762)

    Vulnerability from nvd – Published: 2026-10-13 12:29 – Updated: 2026-10-13 18:17
    VLAI
    Title
    Incorrect boundary conditions in the SVG component
    Summary
    Incorrect boundary conditions in the SVG component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.
    Severity
    No CVSS data available.
    Assigner
    mozilla CNA under the mitre root
    CNA scorecard E 38/100 over 546 records in the last 180 days details
    References
    Impacted products
    Vendor Product Version
    Mozilla Firefox Unaffected: 153.5 , ≤ 153.* (rpm)
    Unaffected: 158 , ≤ * (rpm)
    		Create a notification for this product.
    Mozilla Thunderbird Unaffected: 153.5 , ≤ 153.* (rpm)
    Unaffected: 158 , ≤ * (rpm)
    		Create a notification for this product.
    Credits
    Mozilla
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "Firefox",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "153.*",
              "status": "unaffected",
              "version": "153.5",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "158",
              "versionType": "rpm"
            }
          ]
        },
        {
          "product": "Thunderbird",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "153.*",
              "status": "unaffected",
              "version": "153.5",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "158",
              "versionType": "rpm"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Mozilla"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Incorrect boundary conditions in the SVG component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5."
            }
          ],
          "value": "Incorrect boundary conditions in the SVG component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-13T18:17:17.762Z",
        "orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
        "shortName": "mozilla"
      },
      "references": [
        {
          "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2072438"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-106/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-108/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-109/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-110/"
        }
      ],
      "title": "Incorrect boundary conditions in the SVG component"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
    "assignerShortName": "mozilla",
    "cveId": "CVE-2026-109762",
    "datePublished": "2026-10-13T12:29:31.730Z",
    "dateReserved": "2026-10-13T00:48:30.518Z",
    "dateUpdated": "2026-10-13T18:17:17.762Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-109761 (GCVE-0-2026-109761)

    Vulnerability from nvd – Published: 2026-10-13 12:29 – Updated: 2026-10-13 18:08
    VLAI
    Title
    Use-after-free in the JavaScript: WebAssembly component
    Summary
    Use-after-free in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 158 and Thunderbird 158.
    Severity
    5.4 (Medium)
    CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
    SSVC
    Exploitation: none Automatable: no Technical Impact: partial
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-10-13 14:13 UTC
    CWE
    Assigner
    mozilla CNA under the mitre root
    CNA scorecard E 38/100 over 546 records in the last 180 days details
    References
    Impacted products
    Vendor Product Version
    Mozilla Firefox Unaffected: 158 , ≤ * (rpm)
    		Create a notification for this product.
    Mozilla Thunderbird Unaffected: 158 , ≤ * (rpm)
    		Create a notification for this product.
    Credits
    Mozilla
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 5.4,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "LOW",
              "integrityImpact": "LOW",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-109761",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-13T14:13:33.860835Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-416",
                "description": "CWE-416 Use After Free",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-13T14:18:50.908Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Firefox",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "158",
              "versionType": "rpm"
            }
          ]
        },
        {
          "product": "Thunderbird",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "158",
              "versionType": "rpm"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Mozilla"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Use-after-free in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 158 and Thunderbird 158."
            }
          ],
          "value": "Use-after-free in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 158 and Thunderbird 158."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-13T18:08:25.527Z",
        "orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
        "shortName": "mozilla"
      },
      "references": [
        {
          "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2071764"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-106/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-109/"
        }
      ],
      "title": "Use-after-free in the JavaScript: WebAssembly component"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
    "assignerShortName": "mozilla",
    "cveId": "CVE-2026-109761",
    "datePublished": "2026-10-13T12:29:31.477Z",
    "dateReserved": "2026-10-13T00:48:27.874Z",
    "dateUpdated": "2026-10-13T18:08:25.527Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-109760 (GCVE-0-2026-109760)

    Vulnerability from nvd – Published: 2026-10-13 12:29 – Updated: 2026-10-13 18:17
    VLAI
    Title
    Mitigation bypass in the Networking: HTTP component
    Summary
    Mitigation bypass in the Networking: HTTP component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.
    Severity
    No CVSS data available.
    Assigner
    mozilla CNA under the mitre root
    CNA scorecard E 38/100 over 546 records in the last 180 days details
    References
    Impacted products
    Vendor Product Version
    Mozilla Firefox Unaffected: 153.5 , ≤ 153.* (rpm)
    Unaffected: 158 , ≤ * (rpm)
    		Create a notification for this product.
    Mozilla Thunderbird Unaffected: 153.5 , ≤ 153.* (rpm)
    Unaffected: 158 , ≤ * (rpm)
    		Create a notification for this product.
    Credits
    Myungyong Lee
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "Firefox",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "153.*",
              "status": "unaffected",
              "version": "153.5",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "158",
              "versionType": "rpm"
            }
          ]
        },
        {
          "product": "Thunderbird",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "153.*",
              "status": "unaffected",
              "version": "153.5",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "158",
              "versionType": "rpm"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Myungyong Lee"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Mitigation bypass in the Networking: HTTP component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5."
            }
          ],
          "value": "Mitigation bypass in the Networking: HTTP component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-13T18:17:16.746Z",
        "orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
        "shortName": "mozilla"
      },
      "references": [
        {
          "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2070633"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-106/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-108/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-109/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-110/"
        }
      ],
      "title": "Mitigation bypass in the Networking: HTTP component"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
    "assignerShortName": "mozilla",
    "cveId": "CVE-2026-109760",
    "datePublished": "2026-10-13T12:29:31.216Z",
    "dateReserved": "2026-10-13T00:48:25.231Z",
    "dateUpdated": "2026-10-13T18:17:16.746Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-109759 (GCVE-0-2026-109759)

    Vulnerability from nvd – Published: 2026-10-13 12:29 – Updated: 2026-10-13 18:17
    VLAI
    Title
    Site isolation issue in the Networking component
    Summary
    Site isolation issue in the Networking component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.
    Severity
    No CVSS data available.
    Assigner
    mozilla CNA under the mitre root
    CNA scorecard E 38/100 over 546 records in the last 180 days details
    References
    Impacted products
    Vendor Product Version
    Mozilla Firefox Unaffected: 153.5 , ≤ 153.* (rpm)
    Unaffected: 158 , ≤ * (rpm)
    		Create a notification for this product.
    Mozilla Thunderbird Unaffected: 153.5 , ≤ 153.* (rpm)
    Unaffected: 158 , ≤ * (rpm)
    		Create a notification for this product.
    Credits
    Myungyong Lee
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "Firefox",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "153.*",
              "status": "unaffected",
              "version": "153.5",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "158",
              "versionType": "rpm"
            }
          ]
        },
        {
          "product": "Thunderbird",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "153.*",
              "status": "unaffected",
              "version": "153.5",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "158",
              "versionType": "rpm"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Myungyong Lee"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Site isolation issue in the Networking component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5."
            }
          ],
          "value": "Site isolation issue in the Networking component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-13T18:17:15.720Z",
        "orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
        "shortName": "mozilla"
      },
      "references": [
        {
          "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2070252"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-106/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-108/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-109/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-110/"
        }
      ],
      "title": "Site isolation issue in the Networking component"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
    "assignerShortName": "mozilla",
    "cveId": "CVE-2026-109759",
    "datePublished": "2026-10-13T12:29:30.787Z",
    "dateReserved": "2026-10-13T00:48:22.956Z",
    "dateUpdated": "2026-10-13T18:17:15.720Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-109757 (GCVE-0-2026-109757)

    Vulnerability from nvd – Published: 2026-10-13 12:29 – Updated: 2026-10-13 18:17
    VLAI
    Title
    Sandbox escape due to race condition in the Networking component
    Summary
    Sandbox escape due to race condition in the Networking component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.
    Severity
    No CVSS data available.
    Assigner
    mozilla CNA under the mitre root
    CNA scorecard E 38/100 over 546 records in the last 180 days details
    References
    Impacted products
    Vendor Product Version
    Mozilla Firefox Unaffected: 153.5 , ≤ 153.* (rpm)
    Unaffected: 158 , ≤ * (rpm)
    		Create a notification for this product.
    Mozilla Thunderbird Unaffected: 153.5 , ≤ 153.* (rpm)
    Unaffected: 158 , ≤ * (rpm)
    		Create a notification for this product.
    Credits
    Yaqoub Aldurayhim
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "Firefox",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "153.*",
              "status": "unaffected",
              "version": "153.5",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "158",
              "versionType": "rpm"
            }
          ]
        },
        {
          "product": "Thunderbird",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "153.*",
              "status": "unaffected",
              "version": "153.5",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "158",
              "versionType": "rpm"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Yaqoub Aldurayhim"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Sandbox escape due to race condition in the Networking component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5."
            }
          ],
          "value": "Sandbox escape due to race condition in the Networking component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-13T18:17:14.519Z",
        "orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
        "shortName": "mozilla"
      },
      "references": [
        {
          "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2069910"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-106/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-108/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-109/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-110/"
        }
      ],
      "title": "Sandbox escape due to race condition in the Networking component"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
    "assignerShortName": "mozilla",
    "cveId": "CVE-2026-109757",
    "datePublished": "2026-10-13T12:29:30.583Z",
    "dateReserved": "2026-10-13T00:30:01.156Z",
    "dateUpdated": "2026-10-13T18:17:14.519Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-109756 (GCVE-0-2026-109756)

    Vulnerability from nvd – Published: 2026-10-13 12:29 – Updated: 2026-10-14 03:59
    VLAI
    Title
    Privilege escalation in the DOM: Navigation component
    Summary
    Privilege escalation in the DOM: Navigation component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.
    Severity
    8.8 (High)
    CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
    SSVC
    Exploitation: none Automatable: no Technical Impact: total
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-10-13 00:00 UTC
    CWE
    • CWE-269 - Improper Privilege Management
    Assigner
    mozilla CNA under the mitre root
    CNA scorecard E 38/100 over 546 records in the last 180 days details
    References
    Impacted products
    Vendor Product Version
    Mozilla Firefox Unaffected: 153.5 , ≤ 153.* (rpm)
    Unaffected: 158 , ≤ * (rpm)
    		Create a notification for this product.
    Mozilla Thunderbird Unaffected: 153.5 , ≤ 153.* (rpm)
    Unaffected: 158 , ≤ * (rpm)
    		Create a notification for this product.
    Credits
    Mozilla
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 8.8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-109756",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-13T00:00:00+00:00",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-269",
                "description": "CWE-269 Improper Privilege Management",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-14T03:59:04.701Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Firefox",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "153.*",
              "status": "unaffected",
              "version": "153.5",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "158",
              "versionType": "rpm"
            }
          ]
        },
        {
          "product": "Thunderbird",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "153.*",
              "status": "unaffected",
              "version": "153.5",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "158",
              "versionType": "rpm"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Mozilla"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Privilege escalation in the DOM: Navigation component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5."
            }
          ],
          "value": "Privilege escalation in the DOM: Navigation component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-13T18:17:13.518Z",
        "orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
        "shortName": "mozilla"
      },
      "references": [
        {
          "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2069258"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-106/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-108/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-109/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-110/"
        }
      ],
      "title": "Privilege escalation in the DOM: Navigation component"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
    "assignerShortName": "mozilla",
    "cveId": "CVE-2026-109756",
    "datePublished": "2026-10-13T12:29:30.297Z",
    "dateReserved": "2026-10-13T00:30:00.327Z",
    "dateUpdated": "2026-10-14T03:59:04.701Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-109755 (GCVE-0-2026-109755)

    Vulnerability from nvd – Published: 2026-10-13 12:29 – Updated: 2026-10-13 18:08
    VLAI
    Title
    Sandbox escape in the DOM: Content Processes component
    Summary
    Sandbox escape in the DOM: Content Processes component. This vulnerability was fixed in Firefox 158 and Thunderbird 158.
    Severity
    No CVSS data available.
    Assigner
    mozilla CNA under the mitre root
    CNA scorecard E 38/100 over 546 records in the last 180 days details
    References
    Impacted products
    Vendor Product Version
    Mozilla Firefox Unaffected: 158 , ≤ * (rpm)
    		Create a notification for this product.
    Mozilla Thunderbird Unaffected: 158 , ≤ * (rpm)
    		Create a notification for this product.
    Credits
    Mozilla
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "Firefox",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "158",
              "versionType": "rpm"
            }
          ]
        },
        {
          "product": "Thunderbird",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "158",
              "versionType": "rpm"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Mozilla"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Sandbox escape in the DOM: Content Processes component. This vulnerability was fixed in Firefox 158 and Thunderbird 158."
            }
          ],
          "value": "Sandbox escape in the DOM: Content Processes component. This vulnerability was fixed in Firefox 158 and Thunderbird 158."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-13T18:08:22.816Z",
        "orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
        "shortName": "mozilla"
      },
      "references": [
        {
          "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2068448"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-106/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-109/"
        }
      ],
      "title": "Sandbox escape in the DOM: Content Processes component"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
    "assignerShortName": "mozilla",
    "cveId": "CVE-2026-109755",
    "datePublished": "2026-10-13T12:29:30.078Z",
    "dateReserved": "2026-10-13T00:29:59.501Z",
    "dateUpdated": "2026-10-13T18:08:22.816Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-109754 (GCVE-0-2026-109754)

    Vulnerability from nvd – Published: 2026-10-13 12:29 – Updated: 2026-10-13 18:17
    VLAI
    Title
    Incorrect boundary conditions in the DOM: Editor component
    Summary
    Incorrect boundary conditions in the DOM: Editor component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.
    Severity
    No CVSS data available.
    Assigner
    mozilla CNA under the mitre root
    CNA scorecard E 38/100 over 546 records in the last 180 days details
    References
    Impacted products
    Vendor Product Version
    Mozilla Firefox Unaffected: 153.5 , ≤ 153.* (rpm)
    Unaffected: 158 , ≤ * (rpm)
    		Create a notification for this product.
    Mozilla Thunderbird Unaffected: 153.5 , ≤ 153.* (rpm)
    Unaffected: 158 , ≤ * (rpm)
    		Create a notification for this product.
    Credits
    Mozilla
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "Firefox",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "153.*",
              "status": "unaffected",
              "version": "153.5",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "158",
              "versionType": "rpm"
            }
          ]
        },
        {
          "product": "Thunderbird",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "153.*",
              "status": "unaffected",
              "version": "153.5",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "158",
              "versionType": "rpm"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Mozilla"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Incorrect boundary conditions in the DOM: Editor component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5."
            }
          ],
          "value": "Incorrect boundary conditions in the DOM: Editor component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-13T18:17:12.546Z",
        "orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
        "shortName": "mozilla"
      },
      "references": [
        {
          "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2068443"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-106/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-108/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-109/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-110/"
        }
      ],
      "title": "Incorrect boundary conditions in the DOM: Editor component"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
    "assignerShortName": "mozilla",
    "cveId": "CVE-2026-109754",
    "datePublished": "2026-10-13T12:29:29.732Z",
    "dateReserved": "2026-10-13T00:29:58.679Z",
    "dateUpdated": "2026-10-13T18:17:12.546Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}