Mozilla Firefox and Thunderbird: Incorrect boundary conditions in JavaScript Engine
Summary
Mozilla Firefox, Firefox ESR and Thunderbird contain a memory safety flaw (incorrect boundary conditions) in the JavaScript Engine. An attacker can exploit it by luring a user to a malicious web page, which may allow high confidentiality and integrity impact. Thunderbird exposure is lower because scripting is disabled when reading mail.
Affected
- Firefox versions before 158, Firefox ESR 115 before 115.43, and Firefox ESR 153 before 153.5
- Thunderbird versions before 158 and Thunderbird 153 before 153.5
- Exact affected version ranges: Unknown.
Fixed in
- Firefox 158
- Firefox ESR 115.43
- Firefox ESR 153.5
- Thunderbird 158
- Thunderbird 153.5
Workaround
- No workaround documented. Update to the fixed release.
Exploitation
- Exploited in the wild: not confirmed.
- CISA SSVC: Exploitation none, Automatable no, Technical Impact partial.
- A public exploit entry exists on vulners.com but is unverified.
Our recommendation
- Update Firefox to 158 or ESR to 115.43 / 153.5, and Thunderbird to 158 or 153.5.
- Confirm that all managed workstations and ESR clients have been updated.
- Apply the other Mozilla fixes in MFSA 2026-106 to 110 in the same cycle.
- Verify the Ubuntu Thunderbird 22.04 status with Canonical if you use that distribution.
Public exploits
Links to third-party sites, not checked by us – exploit code can contain malware. Only use it in isolated test environments.
- Proof of concept on GitHub (1 repositories)
Scyrix-LLC/CVE-2026-109715
Research sources
- Mozilla Bugzilla bug 2073267 bugzilla.mozilla.org
- Mozilla MFSA 2026-106 (Firefox 158) www.mozilla.org
- Mozilla MFSA 2026-107 (Firefox ESR 115.43) www.mozilla.org
- Mozilla MFSA 2026-108 www.mozilla.org
- Mozilla MFSA 2026-109 (Thunderbird 158) www.mozilla.org
- Mozilla MFSA 2026-110 (Thunderbird 153.5) www.mozilla.org
- Ubuntu CVE-2026-109715 ubuntu.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 19:54.
Original description (NVD)
Incorrect boundary conditions in the JavaScript Engine component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.
NVD references (6)
- https://bugzilla.mozilla.org/show_bug.cgi?id=2073267
- https://www.mozilla.org/security/advisories/mfsa2026-106/
- https://www.mozilla.org/security/advisories/mfsa2026-107/
- https://www.mozilla.org/security/advisories/mfsa2026-108/
- https://www.mozilla.org/security/advisories/mfsa2026-109/
- https://www.mozilla.org/security/advisories/mfsa2026-110/
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.