Mozilla Firefox and Thunderbird: Privilege escalation in WebExtensions
Summary
A flaw in the WebExtensions component of Mozilla Firefox and Thunderbird allows privilege escalation. An attacker who already has a foothold, such as a low-privilege account or the ability to get an extension installed, could gain higher privileges. The CVSS vector rates the impact as high for confidentiality, integrity and availability. Mozilla fixed the issue in Firefox 158 and Thunderbird 158.
Affected
- Firefox: versions before 158 (per the CVE record; exact range not verified)
- Thunderbird: versions before 158 (per the CVE record; exact range not verified)
- ESR builds: Unknown.
Fixed in
- Firefox 158 (per the CVE record and MFSA 2026-106)
- Thunderbird 158 (per the CVE record; confirm in MFSA 2026-109)
- Later point releases such as 158.0.1 are newer builds on the same branch; whether they add fixes for this CVE is unverified.
Workaround
Unknown. No workaround has been published; the vendor recommends updating.
Exploitation
- CISA SSVC: exploitation none, not automatable, total technical impact.
- No evidence of exploitation in the wild was found in the sources reviewed.
- No public proof of concept was found.
Our recommendation
- Update Firefox and Thunderbird to version 158 or later on all endpoints, prioritising systems with browsers and mail clients.
- Verify that automatic updates are enabled across the fleet.
- Check the Ubuntu and other distribution trackers for distribution-specific status.
- Monitor for unusual browser extension installations.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Mozilla MFSA 2026-106 www.mozilla.org
- Mozilla MFSA 2026-109 www.mozilla.org
- Mozilla Bugzilla 2049069 bugzilla.mozilla.org
- Ubuntu CVE page ubuntu.com
- HKCERT Mozilla bulletin www.hkcert.org
- HOL CVE page hol.org
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 20:13.
Original description (NVD)
Privilege escalation in the WebExtensions component. This vulnerability was fixed in Firefox 158 and Thunderbird 158.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.