Threat database

An integer overflow vulnerability exists in the Layout: Text and Fonts component of Mozilla Firefox. This flaw was addressed and fixed in Firefox version 158 and Firefox ESR 153.5, as well as Thunderbird versions 158 and 153.5. The vulnerability has a medium severity rating with a CVSS score of 5.4. No known exploits are reported in the wild at this time.

CVE-2026-109721 is a medium severity vulnerability in Mozilla Firefox's JavaScript Engine JIT component caused by incorrect boundary conditions. It affects Firefox versions prior to 158 and was fixed in Firefox 158 and Firefox ESR 153.5. The vulnerability also affects Thunderbird and was fixed in Thunderbird 158 and Thunderbird 153.5. It has a CVSS score of 5.4 and does not have known exploits in the wild.

CVE-2026-109720 is a high-severity vulnerability in Mozilla Firefox involving a JIT miscompilation issue in the JavaScript WebAssembly component. This flaw could lead to high confidentiality impact with limited integrity impact and no availability impact. The vulnerability was fixed in Firefox 158 and Firefox ESR 153.5, as well as Thunderbird 158 and Thunderbird 153.5.

Use-after-free in the DOM: Bindings (WebIDL) component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.

CVE-2026-109714 is a medium severity vulnerability in Mozilla Firefox caused by incorrect boundary conditions in the Layout component. This flaw could lead to limited confidentiality and integrity impacts but does not affect availability. The issue was fixed in Firefox version 158 and Thunderbird version 158.

Use-after-free in the Crash Reporting component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.

Use-after-free in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.

CVE-2026-109709 is a high-severity vulnerability in Mozilla Firefox's Security: Process Sandboxing component that allows information disclosure and privilege escalation. It affects Firefox versions prior to 158 and was fixed in Firefox 158 and Firefox ESR 153.5. The vulnerability also impacts Thunderbird with fixes in versions 158 and 153.5. The CVSS score is 8.8, indicating a critical impact on confidentiality, integrity, and availability. No known exploits in the wild have been reported. Official vendor advisories provide patch details.

CVE-2026-109708 is a critical sandbox escape vulnerability in Mozilla Firefox's Networking component caused by incorrect boundary conditions. It allows an attacker to potentially break out of the sandbox environment, impacting confidentiality, integrity, and availability. The issue affects Firefox versions prior to 158 and was fixed in Firefox 158 and Firefox ESR 153.5, as well as Thunderbird 158 and Thunderbird 153.5.

Sandbox escape due to use-after-free in the Networking component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.

Sandbox escape, site isolation issue due to incorrect boundary conditions, use-after-free in the Networking component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.

CVE-2026-109704 is a high-severity privilege escalation vulnerability in the Application Update component of Mozilla Firefox and Thunderbird. It allows an attacker with limited privileges to escalate their privileges, potentially leading to full system compromise. The issue has been fixed in Firefox version 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.

CVE-2026-109753 is a high-severity vulnerability in Mozilla Firefox caused by incorrect boundary conditions in the Layout component. It affects Firefox and Thunderbird versions prior to Firefox 158, Firefox ESR 115.43, and Firefox ESR 153.5. The vulnerability allows for high impact on confidentiality and integrity but does not affect availability. Mozilla has issued official fixes in the specified versions.

CVE-2026-109733 is a high-severity vulnerability in Mozilla Firefox's JavaScript engine caused by a JIT miscompilation issue. This flaw affects Firefox versions prior to 158, Firefox ESR versions prior to 115.43 and 153.5, as well as Thunderbird versions prior to 158 and 153.5. The vulnerability allows for high impact on confidentiality and integrity but does not affect availability. Mozilla has released official fixes in Firefox 158, Firefox ESR 115.43, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.

Use-after-free in the DOM: Streams component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.

An integer overflow vulnerability exists in the Graphics component of Mozilla Firefox. This flaw was addressed and fixed in Firefox 158, Firefox ESR 115.43, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5. The vulnerability has a high severity rating with a CVSS score of 8.8, indicating it could lead to significant impact if exploited.

Use-after-free in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.

Use-after-free in the DOM: Animation component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.

Use-after-free in the Audio/Video component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.

Use-after-free in the SVG component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.