Mozilla Firefox: Sandbox escape due to use-after-free in the Networking component
Summary
A use-after-free flaw in the Networking component of Mozilla Firefox, Firefox ESR and Thunderbird allows a sandbox escape. According to the CVE record, an attacker can use it to break out of the browser sandbox, which the CVSS vector rates as high impact on confidentiality, integrity and availability. The attack is network-based and requires no privileges, but a user must interact, for example by opening a malicious web page.
Affected
- Firefox before 158\n- Firefox ESR 153 before 153.5\n- Firefox ESR 115 before 115.44 (the sources differ and also cite 115.43)\n- Thunderbird 153 before 153.5 and Thunderbird before 158
Fixed in
- Firefox 158\n- Firefox ESR 153.5\n- Firefox ESR 115.44 (to be verified against MFSA 2026-106 and MFSA 2026-108)\n- Thunderbird 158 and Thunderbird 153.5\n- Debian 12 firefox-esr: 153.5.0esr-1~deb12u1
Workaround
Unknown. No workaround is documented in the sources reviewed; updating is the fix.
Exploitation
- No exploitation reported in the sources reviewed.\n- CISA SSVC assessment: exploitation none, not automatable.\n- No public proof of concept found. Unknown.
Our recommendation
- Update Firefox, Firefox ESR and Thunderbird to the newest fixed release.\n- Confirm that automatic updates work on all endpoints.\n- Review ESR 115 installations and confirm the fixed build with Mozilla's advisories.\n- Monitor for reports of exploitation.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Mozilla Security Advisory MFSA 2026-106 (Firefox 158) www.mozilla.org
- Mozilla Security Advisory MFSA 2026-108 (Firefox ESR 153.5) www.mozilla.org
- Mozilla Security Advisory MFSA 2026-109 (Thunderbird 158) www.mozilla.org
- Mozilla Security Advisory MFSA 2026-110 (Thunderbird 153.5) www.mozilla.org
- Ubuntu CVE record CVE-2026-109707 ubuntu.com
- OSV record DEBIAN-CVE-2026-109707 osv.dev
- HKCERT security bulletin on Mozilla products www.hkcert.org
- Mozilla known vulnerabilities for Firefox www.mozilla.org
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 23:03.
Original description (NVD)
Sandbox escape due to use-after-free in the Networking component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, Thunderbird 153.5, and Firefox ESR 115.44.
NVD references (6)
- https://bugzilla.mozilla.org/show_bug.cgi?id=2059150
- https://www.mozilla.org/security/advisories/mfsa2026-106/
- https://www.mozilla.org/security/advisories/mfsa2026-108/
- https://www.mozilla.org/security/advisories/mfsa2026-109/
- https://www.mozilla.org/security/advisories/mfsa2026-110/
- https://www.mozilla.org/security/advisories/mfsa2026-119/
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.