Mozilla Firefox: Information disclosure and privilege escalation in sandbox
Summary
Mozilla fixed a flaw in the Security: Process Sandboxing component of Firefox, Firefox ESR and Thunderbird. The vulnerability can lead to information disclosure and privilege escalation. CVSS rates it 8.8 (High) and the attack vector as network, with no privileges required but user interaction, such as opening a malicious page or message. Mozilla has not published technical details, and no active exploitation is known.
Affected
- Firefox versions before 158
- Firefox ESR versions before 153.5
- Thunderbird versions before 158 and before 153.5 (per the fix line in the CVE description)
Fixed in
- Firefox 158 (MFSA 2026-106)
- Firefox ESR 153.5 (MFSA 2026-108)
- Thunderbird 158 (MFSA 2026-109)
- Thunderbird 153.5 (MFSA 2026-110)
- Use the latest build; Mozilla has also released later builds (for example Firefox 158.0.1 and ESR 153.5.1), which were not verified for this CVE.
Workaround
Unknown. No workaround from Mozilla has been identified; updating is the only confirmed mitigation.
Exploitation
- No evidence of exploitation in the wild found; not listed in CISA KEV in the sources reviewed.
- No public proof of concept found.
- Mozilla's advisory does not describe the attack chain.
Our recommendation
- Update Firefox to 158 or later, Firefox ESR to 153.5 or later, and Thunderbird to 158 or 153.5 or later on all endpoints, prioritising systems that browse untrusted sites or receive external mail.
- On Ubuntu 22.04, confirm that the Thunderbird package update has been installed.
- Check the NVD and Mozilla advisories for updates, as the NVD status was reported as Deferred.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Mozilla Bugzilla bug 2067976 bugzilla.mozilla.org
- Mozilla MFSA 2026-106 (Firefox 158) www.mozilla.org
- Mozilla MFSA 2026-108 (Firefox ESR 153.5) www.mozilla.org
- Mozilla MFSA 2026-109 (Thunderbird 158) www.mozilla.org
- Mozilla MFSA 2026-110 (Thunderbird 153.5) www.mozilla.org
- Mozilla security advisories index www.mozilla.org
- Debian OSV record CVE-2026-109709 osv.dev
- Ubuntu security tracker CVE-2026-109709 ubuntu.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 20:14.
Original description (NVD)
Information disclosure, privilege escalation in the Security: Process Sandboxing component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.