Mozilla Firefox and Thunderbird: Site isolation issue in Networking component

Summary

Mozilla Firefox, Firefox ESR and Thunderbird contain a site isolation issue in the Networking component. The CVE record rates the impact as high for confidentiality and integrity. Exploitation requires a user to visit a malicious or compromised web page or open content that triggers the flaw. No exploitation has been reported.

Affected

• Firefox versions before 158
• Firefox ESR versions before 153.5
• Thunderbird versions before 153.5 and before 158 (exact affected range inferred from the fixed versions)

Fixed in

• Firefox 158
• Firefox ESR 153.5
• Thunderbird 153.5
• Thunderbird 158

Workaround

Unknown. No vendor workaround is documented; apply the update.

Exploitation

• No known exploitation in the wild.
• CISA SSVC: exploitation none, not automatable, total technical impact.
• No public proof of concept found.

Our recommendation

• Update Firefox to 158 or later, Firefox ESR to 153.5 or later, and Thunderbird to 153.5 or 158 or later.
• Check the installed version on all workstations, including pinned ESR installations.
• Enable automatic updates where possible.
• Linux users should check distribution packages, as some distributions may backport fixes.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Mozilla Security Advisory MFSA 2026-106 www.mozilla.org
• Mozilla Security Advisory MFSA 2026-108 www.mozilla.org
• Mozilla Security Advisory MFSA 2026-109 www.mozilla.org
• Mozilla Security Advisory MFSA 2026-110 www.mozilla.org
• Mozilla Bugzilla bug 2070252 bugzilla.mozilla.org
• Ubuntu security notice CVE-2026-109759 ubuntu.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 19:47.