Firefox and Thunderbird: Mitigation bypass in DOM Security component
Summary
Mozilla has fixed a mitigation bypass in the DOM Security component of Firefox, Firefox ESR and Thunderbird. The vendor gives no technical details, so the exact attack mechanism is not public. The supplied CVSS vector assumes a remote attacker who needs a user to visit a malicious page or open crafted content, with high confidentiality and integrity impact.
Affected
- Mozilla Firefox versions before 158 and Firefox ESR versions before 153.5
- Mozilla Thunderbird versions before 158 and Thunderbird 153.x before 153.5
- Older branches were not confirmed as affected or unaffected. Unknown.
Fixed in
- Firefox 158
- Firefox ESR 153.5
- Thunderbird 158
- Thunderbird 153.5
- Distribution packages: check your distro's security tracker for exact package versions.
Workaround
Unknown. No official workaround is published. Apply the fixed release.
Exploitation
- No evidence of in-the-wild exploitation found. KEV: No.
- CISA SSVC: Exploitation none, Automatable no, Technical Impact total.
- No public proof of concept found. The Bugzilla bug was not readable during research.
Our recommendation
- Update Firefox to 158 or Firefox ESR to 153.5, and Thunderbird to 158 or 153.5, or install your distro's patched packages.
- Check that auto-update is enabled on managed endpoints and verify versions with your inventory tool.
- On Ubuntu 22.04 LTS, Thunderbird is marked vulnerable. Check the distro patch status.
- Re-check NVD, which currently shows the status Deferred, as the CVSS score may change.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Mozilla MFSA 2026-106 (Firefox 158) www.mozilla.org
- Mozilla MFSA 2026-108 (Firefox ESR 153.5) www.mozilla.org
- Mozilla MFSA 2026-109 (Thunderbird 158) www.mozilla.org
- Mozilla MFSA 2026-110 (Thunderbird 153.5) www.mozilla.org
- Mozilla Bugzilla bug 1926318 bugzilla.mozilla.org
- Ubuntu CVE tracker ubuntu.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 19:52.
Original description (NVD)
Mitigation bypass in the DOM: Security component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.