Mozilla Firefox: Privilege escalation in Panning and Zooming component
Summary
A privilege escalation flaw in the Panning and Zooming component of Mozilla Firefox, Firefox ESR and Thunderbird allows an attacker to gain higher privileges within the application. The CVE record rates it with CVSS 8.8 (network reachable, low complexity, low privileges, no user interaction) and high confidentiality, integrity and availability impact. Mozilla fixed it in Firefox 158, Firefox ESR 153.5, Thunderbird 158 and Thunderbird 153.5.
Affected
- Firefox versions before 158, and the Firefox ESR 153.x branch before 153.5 (inferred from the unaffected ranges in the CVE record; Mozilla gives no explicit affected range)
- Thunderbird versions before 158, and the 153.x branch before 153.5
- Status of older ESR branches (for example ESR 115) and older Thunderbird branches: Unknown.
Fixed in
- Firefox 158 (MFSA 2026-106)
- Firefox ESR 153.5 (MFSA 2026-108), for example Debian firefox-esr 153.5.0esr-1~deb12u1 and AlmaLinux firefox 153.5.0-1.el9_8
- Thunderbird 158 (MFSA 2026-109)
- Thunderbird 153.5 (MFSA 2026-110)
- Exact version numbers for Firefox 158 and Thunderbird: Unknown beyond the product names above; check the Mozilla advisories.
Workaround
- Unknown. No vendor-documented mitigation for unpatched installations was found.
- Update Firefox, Firefox ESR and Thunderbird to the fixed releases and keep automatic updates enabled.
Exploitation
- No evidence of exploitation in the wild was found. Not listed as known exploited in the sources reviewed; verify against the CISA KEV catalogue.
- No public proof of concept was found.
- CISA SSVC assessment: exploitation none, automatable no, technical impact total.
Our recommendation
- Update Firefox, Firefox ESR and Thunderbird on all workstations to the fixed releases listed above.
- Check installed versions centrally, especially on Linux systems where distribution packages are used.
- Ensure automatic updates are enabled and monitor for further Mozilla security advisories, as the same release also fixes other high-impact issues.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Bugzilla 2059195 bugzilla.mozilla.org
- Mozilla MFSA 2026-106 (Firefox 158) www.mozilla.org
- Mozilla MFSA 2026-108 (Firefox ESR 153.5) www.mozilla.org
- Mozilla MFSA 2026-109 (Thunderbird 158) www.mozilla.org
- Mozilla MFSA 2026-110 (Thunderbird 153.5) www.mozilla.org
- OSV Debian firefox-esr advisory osv.dev
- Ubuntu CVE tracker ubuntu.com
- AlmaLinux updates issue 4070 github.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 20:12.
Original description (NVD)
Privilege escalation in the Panning and Zooming component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.