Mozilla Firefox and Thunderbird: Unspecified vulnerability in DOM File component

Summary

Mozilla Firefox, Firefox ESR and Thunderbird contain a vulnerability in the DOM File component, described by Mozilla only as 'Other issue in the DOM: File component'. Mozilla rates the impact as high in its advisory, but the bug report is access-restricted, so the attack details are unknown. The CVSS 8.1 score and CWE-79 classification in the input could not be confirmed and should be checked against NVD before use.

Affected

• Mozilla Firefox and Firefox ESR before 158 / 153.5 (exact affected range not stated in the sources)
• Mozilla Thunderbird before 158 / 153.5 (exact affected range not stated in the sources)
• Ubuntu 22.04 LTS (jammy): thunderbird listed as vulnerable

Fixed in

• Firefox 158 or later
• Firefox ESR 153.5 or later
• Thunderbird 158 or later
• Thunderbird 153.5 or later

Workaround

Unknown. No vendor workaround found; install the fixed versions.

Exploitation

• CISA SSVC: exploitation none, not automatable, total technical impact
• Not listed as known exploited (KEV) according to Strix
• No public proof of concept and no reports of in-the-wild exploitation found
• Absence of exploitation is not confirmed

Our recommendation

• Update Firefox, Firefox ESR and Thunderbird to the fixed versions, prioritising managed Thunderbird installs, ESR deployments and Linux packages
• Check which browser and mail client versions are in use on all endpoints
• Verify the version against the vendor advisories and NVD, since the severity data in the input is unconfirmed
• Monitor vendor advisories for further information

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Mozilla Security Advisory MFSA 2026-106 (Firefox 158) www.mozilla.org
• Mozilla Security Advisory MFSA 2026-108 (Firefox ESR) www.mozilla.org
• Mozilla Security Advisory MFSA 2026-109 www.mozilla.org
• Mozilla Security Advisory MFSA 2026-110 www.mozilla.org
• Mozilla Bugzilla bug 2059211 bugzilla.mozilla.org
• Ubuntu CVE tracker entry ubuntu.com
• SUSE CVE entry via Vulners vulners.com
• HKCERT security bulletin on Mozilla products www.hkcert.org

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 19:48.