Mozilla Firefox: Sandbox escape due to uninitialized memory in Web Serial
Summary
A flaw in the Web Serial component of the DOM in Mozilla Firefox and Thunderbird allows a sandbox escape caused by use of uninitialized memory. The CVSS 3.1 score of 9.6 (Critical) comes from the CVE listing, but NVD analysis is still pending and Mozilla's own impact rating for this CVE could not be confirmed from the sources. A remote attacker could exploit this by convincing a user to visit a malicious web page, which requires user interaction but no authentication. The sandbox escape is typically a second stage that is chained with a separate browser compromise.
Affected
- Mozilla Firefox before 158 (inferred from the fixed version, not a stated range)
- Mozilla Firefox ESR before 153.5 (inferred)
- Mozilla Thunderbird before 158 and before 153.5 (inferred)
- Unknown: whether Firefox ESR 115.x is affected. No source lists this CVE for the 115 line.
Fixed in
- Firefox 158 (MFSA 2026-106)
- Firefox ESR 153.5 (MFSA 2026-108)
- Thunderbird 158 and Thunderbird 153.5 (MFSA 2026-109 and 2026-110; details not verified)
- Distributions such as Debian and openSUSE publish their own package versions; check your vendor notice.
Workaround
Unknown. No workaround is documented in the sources checked. Updating is the fix. Whether Web Serial can be disabled through enterprise policy has not been verified.
Exploitation
- Exploited in the wild: no evidence found. Reported as not known exploited in the sources checked; CISA KEV was not checked directly.
- Public proof of concept: none found in limited searches.
- The reporter is listed as Mozilla, so the bug was probably found internally.
- CISA SSVC: Exploitation none, Automatable no, Technical Impact total.
Our recommendation
- Update Firefox to 158 or Firefox ESR to 153.5, and Thunderbird to 158 or 153.5, or install the current distribution package.
- Verify that automatic updates work on all workstations and check the installed versions.
- Make sure browsers that are still on older versions are not used for sensitive work until they are updated.
- Monitor Mozilla and your distribution's security notices for changes to the severity rating and for any exploitation reports.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Mozilla MFSA 2026-106 (Firefox 158) www.mozilla.org
- Mozilla MFSA 2026-108 (Firefox ESR 153.5) www.mozilla.org
- Mozilla MFSA 2026-109 www.mozilla.org
- Mozilla MFSA 2026-110 www.mozilla.org
- Mozilla Bugzilla 2061784 (access restricted) bugzilla.mozilla.org
- Ubuntu security notice CVE-2026-109745 ubuntu.com
- SUSE CVE data via Vulners vulners.com
- Vulners VulnRichment CVE-2026-109745 vulners.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 23:00.
Original description (NVD)
Sandbox escape due to uninitialized memory in the DOM: Web Serial component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.