Firefox and Thunderbird: Site isolation issue in DOM Web Authentication component
Summary
Mozilla Firefox and Thunderbird before version 158 contain a site isolation issue in the DOM Web Authentication component. The CVE record describes only this issue, and the accessible sources give no technical details, so the exact impact is unknown; the CISA SSVC assessment in the record rates the technical impact as total. The supplied vector (network, no privileges, user interaction required) points to a malicious web page or message as the attack path. The CVSS score of 9.6 could not be verified, and NVD analysis was still pending at the time of research.
Affected
- Mozilla Firefox: versions before 158
- Mozilla Thunderbird: versions before 158
Fixed in
- Firefox 158 (MFSA 2026-106)
- Thunderbird 158 (MFSA 2026-109)
- Unknown whether later point releases or Firefox ESR versions include the fix for this CVE.
Workaround
Unknown.
- No vendor workaround identified. Apply the vendor update.
Exploitation
- No evidence of exploitation in the wild found in the sources reviewed.
- CISA SSVC assessment: exploitation none, automatable no.
- No public proof of concept found.
- Verify the KEV status directly with CISA.
Our recommendation
- Update Firefox and Thunderbird to the newest available release on all endpoints, including ESR, portable and distribution-packaged copies.
- Prioritise this update because browsers and mail clients are exposed to untrusted content by design.
- Verify the installed version after the update.
- Check the NVD entry for the final CVSS score once analysis is complete.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Mozilla Security Advisory MFSA 2026-106 (Firefox 158) www.mozilla.org
- Mozilla Security Advisory MFSA 2026-109 (Thunderbird 158) www.mozilla.org
- Mozilla Bugzilla bug 2067571 bugzilla.mozilla.org
- Ubuntu security tracker CVE-2026-109750 ubuntu.com
- Strix CVE-2026-109750 www.strix.ai
- CVE-2026-109750 tracker (threatint) cve.threatint.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 23:01.
Original description (NVD)
Site isolation issue in the DOM: Web Authentication component. This vulnerability was fixed in Firefox 158 and Thunderbird 158.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.