Mozilla Firefox, Thunderbird: Privilege escalation in Application Update
Summary
Mozilla Firefox and Thunderbird contain a privilege escalation flaw in the Application Update component, which is the built-in updater of both products. According to the CVE record, an attacker with low privileges can exploit it over the network without user interaction, which could lead to high impact on confidentiality, integrity and availability. The flaw is fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158 and Thunderbird 153.5.
Affected
- Firefox versions before 158 and Firefox ESR versions before 153.5
- Thunderbird versions before 158 and Thunderbird ESR versions before 153.5
- Whether Firefox ESR 115 is affected is unknown; verify against Mozilla advisory MFSA 2026-106.
Fixed in
- Firefox 158
- Firefox ESR 153.5
- Thunderbird 158
- Thunderbird 153.5
- Later releases such as Firefox 158.0.1 also contain the fix.
Workaround
Unknown.
Exploitation
- CISA SSVC assessment: exploitation none, automatable no, technical impact total.
- No public exploitation is known at the time of research.
Our recommendation
- Update Firefox and Thunderbird to version 158 or 153.5 ESR, or a later release, on all workstations and servers.
- Check your inventory for installations of both products, including ESR builds, and confirm the installed version.
- Monitor Mozilla advisories for updates and verify the status of ESR 115 builds in your environment.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Mozilla Bugzilla bug 2037979 bugzilla.mozilla.org
- Mozilla MFSA 2026-106 (Firefox 158) www.mozilla.org
- Mozilla MFSA 2026-109 (Thunderbird 158) www.mozilla.org
- Mozilla MFSA 2026-110 www.mozilla.org
- Ubuntu CVE-2026-109704 ubuntu.com
- Tenable plugin 365350 www.tenable.com
- Mozilla known vulnerabilities: Firefox www.mozilla.org
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 20:14.
Original description (NVD)
Privilege escalation in the Application Update component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.