Mozilla Firefox and Thunderbird: Sandbox escape in Networking component
Summary
A flaw in the Networking component of Mozilla Firefox and Thunderbird allows a sandbox escape caused by incorrect boundary conditions. Mozilla rates the issue as high impact and CVSS 9.6 (Critical). An attacker could lure a user to a malicious web page or content and, combined with other flaws, break out of the sandbox to access more privileged parts of the application.
Affected
- Mozilla Firefox: versions prior to 158, Firefox ESR 115.44 and later 115.x are unaffected, Firefox ESR 153.5 is the fixed branch (per CVE record: unaffected 115.44 to <= 115.*, 153.5 to <= 153.*, 158 to <= *)
- Mozilla Thunderbird: versions prior to 153.5 and 158 (per CVE record)
- Distribution packages (Debian): firefox-esr on Debian 12 before 153.5.0esr-1~deb12u1
- Ubuntu: Thunderbird on 22.04 LTS (jammy) listed as vulnerable, Firefox listed as not affected
Fixed in
- Firefox 158
- Firefox ESR 153.5
- Firefox ESR 115.44
- Thunderbird 158
- Thunderbird 153.5
- Debian firefox-esr 153.5.0esr-1~deb12u1 (DSA 6560-1, DLA 4836-1)
- Ubuntu Thunderbird fixed version: Unknown.
Workaround
Unknown. No documented workaround was found in the sources reviewed.
Exploitation
- Not known to be exploited in the wild according to the sources reviewed; CISA SSVC lists exploitation as none and automatable as no.
- EPSS listed at 0.32%.
- No public proof of concept found; this is not confirmed absent.
Our recommendation
- Update Firefox, Firefox ESR, and Thunderbird on all endpoints to the fixed versions listed above.
- For Linux-managed installs, apply the distribution updates (for example Debian DSA 6560-1 and DLA 4836-1; check Ubuntu for the Thunderbird 22.04 patch).
- Inventory all Firefox and Thunderbird installations, including managed and portable copies, and verify their versions.
- Monitor for vendor updates and known exploitation reports.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Mozilla Security Advisory MFSA 2026-106 (Firefox 158) www.mozilla.org
- Mozilla Bugzilla bug 2059151 bugzilla.mozilla.org
- Ubuntu CVE-2026-109708 ubuntu.com
- Debian OSV record DEBIAN-CVE-2026-109708 osv.dev
- HKCERT security bulletin Mozilla products www.hkcert.org
- SUSE CVE record via Vulners vulners.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 23:03.
Original description (NVD)
Sandbox escape due to incorrect boundary conditions in the Networking component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, Thunderbird 153.5, and Firefox ESR 115.44.
NVD references (6)
- https://bugzilla.mozilla.org/show_bug.cgi?id=2059151
- https://www.mozilla.org/security/advisories/mfsa2026-106/
- https://www.mozilla.org/security/advisories/mfsa2026-108/
- https://www.mozilla.org/security/advisories/mfsa2026-109/
- https://www.mozilla.org/security/advisories/mfsa2026-110/
- https://www.mozilla.org/security/advisories/mfsa2026-119/
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.