Mozilla Firefox and Thunderbird: Incorrect boundary conditions in JavaScript Engine
Summary
Mozilla Firefox and Thunderbird contain an incorrect boundary condition flaw in the JavaScript Engine component. Per the supplied CVSS vector, a remote attacker can affect confidentiality and integrity if a user with an affected browser or mail client is lured to a malicious or compromised web page, and no privileges are required. Mozilla fixed the issue in Firefox 158, Firefox ESR 115.43, Firefox ESR 153.5, Thunderbird 158 and Thunderbird 153.5.
Affected
- Mozilla Firefox versions before 158 (per CVE record ranges, 158 and later are unaffected)
- Mozilla Firefox ESR 115 before 115.43
- Mozilla Firefox ESR 153 before 153.5
- Mozilla Thunderbird 153 before 153.5
- Mozilla Thunderbird versions before 158 (per CVE record ranges, 158 and later are unaffected)
- Linux distribution packages: check their own advisories (Ubuntu 22.04 LTS Thunderbird is marked vulnerable)
Fixed in
- Firefox 158
- Firefox ESR 115.43
- Firefox ESR 153.5
- Thunderbird 158
- Thunderbird 153.5
- Red Hat RHEL 9.8: firefox 153.5.0-1.el9_8
- AlmaLinux 8: firefox 153.5.0-1.el8_10
- Unknown for Thunderbird ESR and the exact Windows and macOS installer builds
Workaround
Unknown. No vendor workaround was identified; applying the update is the required action.
Exploitation
- No known exploitation; not listed in KEV at time of research.
- No public proof of concept found (search was limited).
- CISA SSVC: exploitation none, not automatable, technical impact total.
Our recommendation
- Update all Firefox and Thunderbird installations, including ESR, to the fixed or later builds.
- Check Linux distribution packages against their own advisories.
- Confirm that auto-update is enabled and that managed fleets have actually been upgraded.
- Monitor for new reports of exploitation and re-check the NVD score, which was still pending at time of research.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Mozilla Security Advisory MFSA 2026-106 (Firefox 158) www.mozilla.org
- Mozilla Security Advisory MFSA 2026-109 (Thunderbird) www.mozilla.org
- Mozilla Security Advisory MFSA 2026-110 www.mozilla.org
- Mozilla Bugzilla bug 2073269 (access restricted) bugzilla.mozilla.org
- Ubuntu CVE-2026-109716 ubuntu.com
- Red Hat RHSA-2026:89757 via Vulners vulners.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 19:53.
Original description (NVD)
Incorrect boundary conditions in the JavaScript Engine component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.
NVD references (6)
- https://bugzilla.mozilla.org/show_bug.cgi?id=2073269
- https://www.mozilla.org/security/advisories/mfsa2026-106/
- https://www.mozilla.org/security/advisories/mfsa2026-107/
- https://www.mozilla.org/security/advisories/mfsa2026-108/
- https://www.mozilla.org/security/advisories/mfsa2026-109/
- https://www.mozilla.org/security/advisories/mfsa2026-110/
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.