Threat database

Information disclosure in the Networking component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.

CVE-2026-109750 is a critical vulnerability in Mozilla Firefox involving a site isolation issue in the DOM Web Authentication component. It allows for potential compromise of confidentiality, integrity, and availability. The issue was fixed in Firefox version 158.

Use-after-free in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 158 and Thunderbird 158.

Use-after-free in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 158 and Thunderbird 158.

CVE-2026-109747 is a high-severity vulnerability in the Address Bar component of Mozilla Firefox. It allows for potential confidentiality, integrity, and availability impacts. The issue was fixed in Firefox version 158.

CVE-2026-109746 is a high-severity vulnerability in Mozilla Firefox involving a mitigation bypass in the DOM security component. The issue allows potential compromise of confidentiality, integrity, and availability. It was fixed in Firefox version 158 and Thunderbird version 158.

CVE-2026-109745 is a critical sandbox escape vulnerability in Mozilla Firefox's Web Serial component caused by uninitialized memory in the DOM. This flaw allows an attacker to potentially break out of the browser sandbox, impacting confidentiality, integrity, and availability. The issue was fixed in Firefox 158 and Firefox ESR 153.5, as well as Thunderbird 158 and Thunderbird 153.5.

CVE-2026-109744 is a high-severity vulnerability in Mozilla Firefox related to the DOM File component. It allows for potential high impact on confidentiality and integrity but does not affect availability. The issue was fixed in Firefox 158 and Firefox ESR 153.5, as well as Thunderbird 158 and Thunderbird 153.5.

CVE-2026-109743 is a high-severity privilege escalation vulnerability in the Panning and Zooming component of Mozilla Firefox and Thunderbird. It allows an attacker with limited privileges to escalate their privileges. The issue was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.

Information disclosure in the PDF Viewer component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.

Use-after-free in the Storage: Bucket File System component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.

CVE-2026-109740 is a critical sandbox escape vulnerability in Mozilla Firefox's Widget: Win32 component caused by incorrect boundary conditions. It allows an attacker to potentially execute code outside the sandbox. The issue was fixed in Firefox 158 and Firefox ESR 153.5, as well as Thunderbird 158 and Thunderbird 153.5.

CVE-2026-109739 is a high severity privilege escalation vulnerability in the WebExtensions component of Mozilla Firefox. It allows an attacker with limited privileges to escalate their privileges without user interaction. This vulnerability was fixed in Firefox version 158 and Thunderbird version 158.

Use-after-free in the Audio/Video: Playback component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.

CVE-2026-109737 is a high-severity vulnerability in Mozilla Firefox and Thunderbird involving a mitigation bypass in the Enterprise Policies component. It allows an attacker to bypass security mitigations, potentially leading to high confidentiality and integrity impacts. The issue was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.

CVE-2026-109736 is a high severity vulnerability in Mozilla Firefox's Layout component involving frame poisoning. It allows an attacker to cause high impact on confidentiality and integrity but does not affect availability. The issue was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.

Use-after-free in the DOM: Animation component. This vulnerability was fixed in Firefox 158 and Thunderbird 158.

CVE-2026-109734 is a high-severity vulnerability in Mozilla Firefox involving a mitigation bypass in the DOM security component. It affects Firefox versions prior to 158 and Firefox ESR versions prior to 153.5. The vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5. The CVSS score is 8.1, indicating a significant impact on confidentiality and integrity with no impact on availability. No known exploits in the wild have been reported.

CVE-2026-109731 is a medium severity vulnerability in Mozilla Firefox's Graphics: Canvas2D component caused by incorrect boundary conditions. This flaw could lead to limited confidentiality and integrity impacts but does not affect availability. The issue was fixed in Firefox 158 and Firefox ESR 153.5, as well as Thunderbird 158 and Thunderbird 153.5.

Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.