Mozilla Firefox: Sandbox escape via use-after-free in Networking
Summary
Mozilla Firefox and Thunderbird contain a use-after-free flaw in the Networking component, combined with a site isolation issue caused by incorrect boundary conditions. An attacker who can lure a user to a malicious web page can escape the browser sandbox and act with the privileges of the user, with a CVSS score of 9.6 (critical). User interaction is required, and CISA SSVC rates exploitation as none and not automatable.
Affected
- Firefox versions before 158
- Firefox ESR 153 versions before 153.5
- Firefox ESR 115 versions before 115.44
- Thunderbird versions before 158
- Thunderbird 153 versions before 153.5
Fixed in
- Firefox 158
- Firefox ESR 153.5
- Firefox ESR 115.44
- Thunderbird 158
- Thunderbird 153.5
Workaround
Unknown.
Exploitation
- No known exploitation (CISA SSVC: Exploitation none, Automatable no, Technical Impact total)
Our recommendation
- Update Firefox and Thunderbird to the fixed versions listed above, including all ESR installations
- Verify the installed versions on all workstations, including portable or unmanaged installations
- Monitor for unusual browser behaviour and keep browser security updates on a fast cycle
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Mozilla Foundation Security Advisory mfsa2026-106 www.mozilla.org
- Mozilla Bugzilla bug 2040905 bugzilla.mozilla.org
- Ubuntu Security CVE-2026-109705 ubuntu.com
- Amazon Linux Security Advisory CVE-2026-109705 explore.alas.aws.amazon.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 23:02.
Original description (NVD)
Sandbox escape, site isolation issue due to incorrect boundary conditions, use-after-free in the Networking component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, Thunderbird 153.5, and Firefox ESR 115.44.
NVD references (6)
- https://bugzilla.mozilla.org/show_bug.cgi?id=2040905
- https://www.mozilla.org/security/advisories/mfsa2026-106/
- https://www.mozilla.org/security/advisories/mfsa2026-108/
- https://www.mozilla.org/security/advisories/mfsa2026-109/
- https://www.mozilla.org/security/advisories/mfsa2026-110/
- https://www.mozilla.org/security/advisories/mfsa2026-119/
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.