Mozilla Firefox/Thunderbird: Frame poisoning in the Layout component
Summary
A frame poisoning flaw in the Layout component, which handles page rendering, affects Mozilla Firefox and Thunderbird. Per the CVSS vector in the input, an attacker could gain high confidentiality and integrity impact, and the attack needs user interaction, for example opening a crafted web page. Mozilla rates the bug as moderate, the CISA SSVC assessment shows no exploitation, and fixed versions are available.
Affected
- Mozilla Firefox before 158 and the ESR 153 branch before 153.5 (exact vulnerable range unverified; the CNA record ranges are unclear)
- Mozilla Thunderbird before 158 and before 153.5
- Firefox ESR 115: unknown, not confirmed
Fixed in
- Firefox 158 (MFSA 2026-106)
- Firefox ESR 153.5 (MFSA 2026-108, product mapping unverified)
- Thunderbird 158 (MFSA 2026-109)
- Thunderbird 153.5 (MFSA 2026-110)
Workaround
Unknown. No workaround identified; the fix is a product update.
Exploitation
- No exploitation in the wild known; the CISA SSVC assessment lists exploitation as none and automatable as no
- No public proof of concept found
- The reporter is listed as Mozilla, which suggests internal discovery
Our recommendation
- Update Firefox to 158 or later, Firefox ESR to 153.5 or later, and Thunderbird to 158 or 153.5, depending on the branch in use
- Check Firefox ESR 115 deployments with Mozilla and the Linux distribution tracker, because backports may use different version numbers
- Prioritise by the vendor rating (moderate) and by how much browsing and mail clients are exposed to untrusted content; the CVSS 8.1 score in the input could not be verified
- Verify the CVSS score and CWE (CWE-451 in the input, conflicting values in other sources) against NVD
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Mozilla Security Advisory MFSA 2026-106 (Firefox 158) www.mozilla.org
- Mozilla Security Advisory MFSA 2026-108 www.mozilla.org
- Mozilla Security Advisory MFSA 2026-109 (Thunderbird 158) www.mozilla.org
- Mozilla Security Advisory MFSA 2026-110 (Thunderbird 153.5) www.mozilla.org
- Mozilla Bugzilla bug 2029784 bugzilla.mozilla.org
- Ubuntu CVE tracker entry ubuntu.com
- VulDB entry 417601 vuldb.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 19:50.
Original description (NVD)
Frame poisoning in the Layout component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.