Firefox and Thunderbird: Privilege escalation in WebExtensions
Summary
Mozilla Firefox, Firefox ESR, Thunderbird and Thunderbird ESR contain a privilege escalation flaw in the WebExtensions component, which handles browser and mail-client add-ons. CVSS 8.8 (high) is assigned; Mozilla's own impact rating is not confirmed by the available sources. An attacker who can get a user to interact with malicious content or an add-on could gain elevated privileges within the application. CISA SSVC lists exploitation as none and automatable as no, and no public proof of concept was found.
Affected
- Firefox and Firefox ESR builds before 158 and 153.5 respectively
- Thunderbird and Thunderbird ESR builds before 158 and 153.5 respectively
- Older ESR branches (e.g., 115 or 140): unknown
- Ubuntu tracker: Thunderbird on 22.04 (jammy) is marked vulnerable; Firefox is marked not affected on 22.04, 24.04 and 26.04
Fixed in
- Firefox 158
- Firefox ESR 153.5
- Thunderbird 158
- Thunderbird 153.5
Workaround
- No workaround is reported in the sources.
- Updating to a fixed version is the remedy.
Exploitation
- No exploitation is known. CISA SSVC: exploitation none, automatable no, technical impact total.
- No public proof of concept was found in the reviewed sources.
Our recommendation
- Update Firefox, Firefox ESR, Thunderbird and Thunderbird ESR to the fixed versions listed above.
- For Linux systems, install the distribution's security update, especially Thunderbird on Ubuntu 22.04.
- Check which browser and mail client versions are in use, including managed endpoints.
- Review installed WebExtensions and remove unneeded add-ons.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Mozilla Security Advisory MFSA 2026-106 (Firefox 158) www.mozilla.org
- Mozilla Security Advisory MFSA 2026-109 (Thunderbird 158) www.mozilla.org
- Mozilla Security Advisory MFSA 2026-110 (Thunderbird 153.5) www.mozilla.org
- Mozilla Bugzilla bug 2070547 bugzilla.mozilla.org
- Ubuntu CVE tracker CVE-2026-109778 ubuntu.com
- OSV Debian CVE-2026-109778 vulners.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 20:10.
Original description (NVD)
Privilege escalation in the WebExtensions component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.