Mozilla Firefox and Thunderbird: Sandbox escape due to race condition
Summary
A race condition in the Networking component of Firefox, Firefox ESR and Thunderbird allows a sandbox escape (CWE-362). An attacker who serves malicious web content or sends a message that the user opens could break out of the restricted browser or mail process. Practically, this is usually one step in a chain that also needs a separate renderer exploit. The CVSS base score is 8.3 (High), and Mozilla has released fixes.
Affected
- Firefox and Firefox ESR (versions before the fixed releases)
- Thunderbird (versions before the fixed releases)
- Exact affected version range: Unknown.
Fixed in
- Firefox 158
- Firefox ESR 153.5
- Thunderbird 158
- Thunderbird 153.5
- Red Hat Enterprise Linux 9.8: firefox 153.5.0-1.el9_8
Workaround
Unknown. No workaround is documented. Update to the fixed versions.
Exploitation
- No evidence of active exploitation found. No CISA KEV listing was verified.
- No public proof of concept found.
- CISA SSVC: exploitation none, automatable no, technical impact total.
- EPSS 0.00159 (low).
Our recommendation
- Update Firefox, Firefox ESR and Thunderbird to the fixed versions. Prioritise Thunderbird and ESR installations.
- Check that automatic updates work on all workstations.
- Monitor vendor advisories for further updates.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Mozilla Security Advisory MFSA 2026-106 (Firefox 158) www.mozilla.org
- Mozilla Bugzilla bug 2069910 bugzilla.mozilla.org
- Mozilla security advisories index www.mozilla.org
- Ubuntu security tracker CVE-2026-109757 ubuntu.com
- OSV Ubuntu entry CVE-2026-109757 osv.dev
- Red Hat RHSA-2026:89757 (via Vulners) vulners.com
- Debian OSV entry CVE-2026-109757 (via Vulners) vulners.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 13:54.
Original description (NVD)
Sandbox escape due to race condition in the Networking component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.