Mozilla Firefox and Thunderbird: Sandbox escape in Win32 widget component
Summary
A flaw in the Widget: Win32 component of Firefox and Thunderbird allows a sandbox escape caused by incorrect boundary conditions. The issue is relevant to Windows installations. An attacker would typically need to combine it with another bug, such as a content-process vulnerability triggered by a malicious web page or email, and user interaction is likely required. Mozilla found this bug internally and reports no known exploitation.
Affected
- Mozilla Firefox (desktop) versions before 158 and Firefox ESR versions before 153.5
- Mozilla Thunderbird versions before 158 and Thunderbird 153.5 (exact affected range unconfirmed)
- Earliest affected version: Unknown.
Fixed in
- Firefox 158 or later (MFSA 2026-106)
- Firefox ESR 153.5 or later
- Thunderbird 158 or later (MFSA 2026-109)
- Thunderbird 153.5 or later (MFSA 2026-110)
- Later releases such as Firefox 158.0.1 may also contain the fix; use the current release.
Workaround
- Unknown. No vendor workaround identified; apply the patched release.
Exploitation
- No reports of exploitation in the wild or public proof of concept found in the sources reviewed. CISA SSVC: exploitation none, automatable no, technical impact total. CISA KEV status not checked.
Our recommendation
- Update Firefox to 158 or ESR 153.5 and Thunderbird to 158 or 153.5, or later, on all Windows endpoints within the normal monthly update cycle.
- Check Thunderbird installations on Ubuntu 22.04 LTS against the distribution's security advisories.
- Verify the CVSS score and severity in the NVD and CNA record, as the sources conflict (Mozilla rates the bug moderate; the overall advisory is high).
- Monitor for exploitation evidence and prioritise patching if it appears.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Mozilla Security Advisory MFSA 2026-106 (Firefox 158) www.mozilla.org
- Mozilla Security Advisory MFSA 2026-109 (Thunderbird 158) www.mozilla.org
- Mozilla Security Advisory MFSA 2026-110 (Thunderbird 153.5) www.mozilla.org
- Mozilla Bugzilla 2057113 bugzilla.mozilla.org
- Ubuntu CVE-2026-109740 ubuntu.com
- Mozilla Advisories index www.mozilla.org
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 23:02.
Original description (NVD)
Sandbox escape due to incorrect boundary conditions in the Widget: Win32 component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.