Mozilla Firefox and Thunderbird: Mitigation bypass in Enterprise Policies
Summary
A mitigation bypass in the Enterprise Policies component of Mozilla Firefox and Thunderbird allows circumvention of protections meant to restrict these applications. Mozilla rates the bug as moderate and the CVSS score in the user-provided record is 8.1, but this could not be confirmed against NVD. An attacker would need to lure a user into opening a malicious web page or email, and no privileges are required. No public exploit or in-the-wild exploitation has been reported.
Affected
- Mozilla Firefox and Firefox ESR versions before 158 and before 153.5 (exact vulnerable range unknown from primary sources)
- Mozilla Thunderbird versions before 158 and before 153.5 (exact vulnerable range unknown from primary sources)
- Linux distribution packages may differ; check your distribution's status
Fixed in
- Firefox 158
- Firefox ESR 153.5
- Thunderbird 158
- Thunderbird 153.5
Workaround
Unknown.
Exploitation
- No evidence of in-the-wild exploitation found in the sources reviewed; CISA KEV status not checked directly.
- No public proof of concept found.
- CISA SSVC: Exploitation none, Automatable no, Technical Impact total.
Our recommendation
- Update Firefox, Firefox ESR and Thunderbird to the fixed versions, prioritising managed workstations with restrictive Enterprise Policies and Linux systems using distribution packages.
- Check the installed versions on all workstations and confirm update status.
- Verify the CVSS score and CWE against NVD before reporting, as the sources disagree.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Mozilla Security Advisory MFSA 2026-106 (Firefox 158) www.mozilla.org
- Mozilla Security Advisory MFSA 2026-108 (Firefox ESR 153.5) www.mozilla.org
- Mozilla Security Advisory MFSA 2026-109 www.mozilla.org
- Mozilla Security Advisory MFSA 2026-110 www.mozilla.org
- Mozilla Bugzilla bug 2074406 bugzilla.mozilla.org
- Ubuntu security notice CVE-2026-109766 ubuntu.com
- VulDB entry 417614 vuldb.com
- SUSE CVE entry CVE-2026-109766 vulners.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 19:45.
Original description (NVD)
Mitigation bypass in the Enterprise Policies component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.