Mozilla Firefox and Thunderbird: Invalid pointer in DOM Notifications component
Summary
A memory handling error (invalid pointer, undefined behavior) in the DOM Notifications component affects Mozilla Firefox and Thunderbird. Mozilla's bug report describes a null pointer dereference that crashes the browser when a page with a notification is frozen (back/forward cache). Mozilla does not state whether code execution is possible, but it rates the advisory as high impact. The issue is triggered when a user visits a malicious or crafted web page that shows notifications with icons, so exposure depends on browsing behavior.
Affected
- Mozilla Firefox and Thunderbird versions before 158 (vendor-stated fix in 158; the exact vulnerable range is not confirmed by Mozilla)
- The NVD/CNA affected range lists "unaffected 158 to <= *", which is ambiguous and not verified
- ESR branches: Unknown.
Fixed in
- Firefox 158 (MFSA 2026-106)
- Thunderbird 158 (MFSA 2026-109)
- Firefox 158.0.1 and later: not verified for this specific fix
- ESR fix versions: Unknown.
Workaround
Unknown.
Exploitation
- No evidence of active exploitation in the sources reviewed; CISA KEV status not verified
- No public proof of concept found in the aggregators checked; this does not rule one out
- CVSS 9.8 comes from a third-party aggregator; the NVD record is deferred and was not verified
Our recommendation
- Update Firefox and Thunderbird to version 158 or later now, using auto-update or the distribution's packages
- Check that the ESR or distribution packages you use carry the fix, since ESR versions are not confirmed
- Inventory all desktops with Firefox or Thunderbird and verify the installed versions
- Monitor Mozilla advisories and CISA KEV for changes
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Mozilla Security Advisory MFSA 2026-106 (Firefox 158) www.mozilla.org
- Mozilla Security Advisory MFSA 2026-109 (Thunderbird) www.mozilla.org
- Mozilla Bugzilla 2067657 bugzilla.mozilla.org
- Ubuntu CVE tracker CVE-2026-109774 ubuntu.com
- SUSE CVE entry via Vulners vulners.com
- Mozilla known vulnerabilities, Firefox www.mozilla.org
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 19:06.
Original description (NVD)
Invalid pointer, undefined behavior in the DOM: Notifications component. This vulnerability was fixed in Firefox 158 and Thunderbird 158.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.