Threat database

Denial-of-service in the Sync component. This vulnerability was fixed in Firefox 158 and Thunderbird 158.

Same-origin policy bypass in the DevTools component. This vulnerability was fixed in Firefox 158 and Thunderbird 158.

Information disclosure in the WebRTC: Networking component. This vulnerability was fixed in Firefox 158 and Thunderbird 158.

CVE-2026-109770 is a medium severity spoofing vulnerability in the DOM Web Serial component of Mozilla Firefox and Thunderbird. It allows an attacker to potentially spoof content, impacting confidentiality and integrity but not availability. The issue was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.

Information disclosure in the Networking: Cache component. This vulnerability was fixed in Firefox 158 and Thunderbird 158.

Denial-of-service in the Site Reports component. This vulnerability was fixed in Firefox 158 and Thunderbird 158.

Information disclosure in the Networking component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.

CVE-2026-109766 is a high-severity vulnerability in Mozilla Firefox's Enterprise Policies component that allows mitigation bypass. The issue affects Firefox versions prior to 158 and Firefox ESR versions prior to 153.5. It was addressed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5. The vulnerability has a CVSS score of 8.1, indicating a high impact on confidentiality and integrity, but no impact on availability. No known exploits are reported in the wild.

Race condition, use-after-free in the Graphics: Text component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.

CVE-2026-109764 is a medium severity vulnerability in Mozilla Firefox's Enterprise Policies component that allows mitigation bypass. The issue affects Firefox versions prior to 158 and Firefox ESR versions prior to 153.5. It was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5. The vulnerability has a CVSS score of 5.4, indicating a moderate impact with low complexity to exploit but requiring user interaction. No known exploits are reported in the wild.

Mitigation bypass in the File Handling component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.

CVE-2026-109762 is a high-severity vulnerability in Mozilla Firefox and Thunderbird involving incorrect boundary conditions in the SVG component. This flaw could lead to significant impact on confidentiality, integrity, and availability. The issue was fixed in Firefox version 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.

Use-after-free in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 158 and Thunderbird 158.

CVE-2026-109760 is a high-severity vulnerability in Mozilla Firefox's Networking: HTTP component that allows mitigation bypass. It affects Firefox versions prior to 158 and Firefox ESR versions prior to 153.5. The vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5. The CVSS score is 8.1, indicating a significant impact on confidentiality and integrity with no impact on availability. No known exploits are reported in the wild.

CVE-2026-109759 is a high-severity vulnerability in Mozilla Firefox related to a site isolation issue in the Networking component. It allows unauthorized access that impacts confidentiality and integrity but does not affect availability. The issue has been fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.

CVE-2026-109757 is a high-severity sandbox escape vulnerability in Mozilla Firefox caused by a race condition in the Networking component. It affects Firefox versions prior to 158 and Firefox ESR versions prior to 153.5. The flaw allows an attacker to potentially escape the sandbox environment, impacting confidentiality, integrity, and availability. Mozilla has released official fixes in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.

CVE-2026-109756 is a high-severity privilege escalation vulnerability in the DOM Navigation component of Mozilla Firefox and Thunderbird. It allows an unprivileged user to escalate privileges, potentially leading to full compromise of confidentiality, integrity, and availability. The issue was fixed in Firefox version 158 and Firefox ESR 153.5, as well as Thunderbird 158 and Thunderbird 153.5.

CVE-2026-109755 is a critical sandbox escape vulnerability in the DOM Content Processes component of Mozilla Firefox. It allows an attacker to escape the sandbox environment, potentially leading to complete system compromise. This vulnerability was fixed in Firefox version 158 and Thunderbird version 158.

CVE-2026-109754 is a high-severity vulnerability in Mozilla Firefox involving incorrect boundary conditions in the DOM Editor component. This flaw could lead to high impact on confidentiality and integrity. The issue was fixed in Firefox version 158 and Firefox ESR 153.5, as well as Thunderbird 158 and Thunderbird 153.5.

Use-after-free in the DOM: Workers component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.