Mozilla Firefox and Thunderbird: Incorrect boundary conditions in DOM Editor
Summary
Firefox and Thunderbird contain an incorrect boundary condition in the DOM Editor component, which handles editable page content. An attacker can lure a user to a crafted web page or open crafted mail content to trigger the flaw, which may allow high impact on confidentiality and integrity. No authentication is required, but user interaction is. NVD analysis is still pending, so the 8.1 score is not confirmed by NVD.
Affected
- Mozilla Firefox versions before 158 and Firefox ESR versions before 153.5 (implied by the fixed versions; no explicit affected range found)
- Mozilla Thunderbird versions before 158 and Thunderbird versions before 153.5 (implied by the fixed versions; no explicit affected range found)
Fixed in
- Firefox 158
- Firefox ESR 153.5
- Thunderbird 158
- Thunderbird 153.5
Newer releases may also include this fix; install the current stable or ESR release.
Workaround
Unknown. No mitigation is documented by Mozilla in the sources reviewed; updating is the fix.
Exploitation
- No evidence of exploitation found; sources list it as not known-exploited.
- CISA SSVC assessment: Exploitation none, Automatable no, Technical Impact total.
- No public proof of concept found.
- Mozilla lists the reporter as Mozilla, so the bug was likely found internally.
Our recommendation
- Update Firefox, Firefox ESR and Thunderbird to the current stable or ESR release on all endpoints.
- Verify installed versions on managed devices, especially Thunderbird on older Linux distributions and ESR installations.
- Check Linux distribution package status, as some distributions report Thunderbird as vulnerable.
- Monitor for updates and review Mozilla's advisory impact rating for your product, as Mozilla rates Thunderbird as moderate.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Mozilla MFSA 2026-110 (Thunderbird) www.mozilla.org
- Mozilla MFSA 2026-106 (Firefox 158) www.mozilla.org
- Mozilla MFSA 2026-108 www.mozilla.org
- Mozilla MFSA 2026-109 www.mozilla.org
- Ubuntu CVE-2026-109754 ubuntu.com
- Red Hat RHSA-2026:89757 via Vulners vulners.com
- Vulnrichment via Vulners vulners.com
- Mozilla Bugzilla 2068443 (access restricted) bugzilla.mozilla.org
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 19:46.
Original description (NVD)
Incorrect boundary conditions in the DOM: Editor component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.