Mozilla Firefox and Thunderbird: Sandbox escape in DOM Content Processes
Summary
A sandbox escape in the DOM: Content Processes component of Mozilla Firefox and Thunderbird allows an attacker to break out of the browser or mail client sandbox. The CVSS score of 9.6 (critical) is shown by Ubuntu, but the ratings conflict and NVD analysis is still pending. User interaction is required, for example by loading attacker-controlled web content, and a sandbox escape is usually one stage of a longer attack chain.
Affected
- Mozilla Firefox before 158
- Mozilla Thunderbird before 158
- Ubuntu 22.04 LTS (jammy): Thunderbird marked as Vulnerable
- Status of Firefox ESR and Thunderbird ESR/153.x: Unknown
Fixed in
- Mozilla Firefox 158 (MFSA 2026-106)
- Mozilla Thunderbird 158 (MFSA 2026-109; the CVE is confirmed only in the description)
- Later point releases Firefox 158.0.1 (MFSA 2026-111) and Thunderbird 158.0.1 (MFSA 2026-114); whether they contain further fixes for this CVE is unknown
Workaround
Unknown. No workaround or mitigation was found; updating is the fix.
Exploitation
- No evidence of exploitation in the wild was found; CISA SSVC lists Exploitation: none and Automatable: no.
- No public proof of concept was found.
Our recommendation
- Update Firefox and Thunderbird to version 158 or later, ideally the latest point release, on all endpoints.
- Check ESR and Thunderbird deployments on older Linux distributions, including Ubuntu 22.04 LTS, and confirm the installed versions against the Mozilla advisories.
- Look for unmanaged installations and make sure they are included in the update process.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Mozilla Security Advisory MFSA 2026-106 (Firefox 158) www.mozilla.org
- Mozilla Security Advisory MFSA 2026-109 (Thunderbird 158) www.mozilla.org
- Ubuntu CVE record CVE-2026-109755 ubuntu.com
- Tenable Nessus plugin 365350 (Thunderbird) www.tenable.com
- Red Hat errata RHSA-2026:15892 access.redhat.com
- Mozilla known vulnerabilities: Thunderbird www.mozilla.org
- Mozilla Bugzilla bug 2068448 (access restricted) bugzilla.mozilla.org
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 22:58.
Original description (NVD)
Sandbox escape in the DOM: Content Processes component. This vulnerability was fixed in Firefox 158 and Thunderbird 158.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.