Mozilla Firefox and Thunderbird: Mitigation bypass in DOM Core & HTML
Summary
Mozilla Firefox and Thunderbird contain a mitigation bypass in the DOM: Core & HTML component. According to the CVE record, it is rated critical with CVSS 9.8 and a network attack vector that requires no privileges or user interaction. CISA SSVC rates it as automatable with total technical impact, and no exploitation is known. Mozilla's advisory text could only be partly verified and Ubuntu rates the issue Medium, so the severity should be checked against NVD and Mozilla.
Affected
- Mozilla Firefox before 158 (inferred from the fix statement; exact range not stated)
- Mozilla Thunderbird before 158
- Ubuntu 22.04 LTS thunderbird: vulnerable
Fixed in
- Firefox 158 (MFSA 2026-106)
- Thunderbird 158 (MFSA 2026-109; CVE not visible in the retrieved text)
- Unknown whether Thunderbird 158.0.1 or ESR releases contain this fix
Workaround
Unknown. No workaround is documented; updating is the practical mitigation.
Exploitation
- Not known as exploited. CISA SSVC: exploitation none, automatable yes, technical impact total
- No public proof of concept found in the sources; treated as unknown
Our recommendation
- Update Firefox and Thunderbird to version 158 or later on all endpoints
- Update Ubuntu 22.04 systems with Thunderbird, which are listed as vulnerable
- Verify installed versions centrally and monitor vendor advisories for ESR and point-release status
- Prioritise this patch because of the high-impact vector, even though exploitation is not known
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Bugzilla bug 2072775 bugzilla.mozilla.org
- Mozilla MFSA 2026-106 (Firefox 158) www.mozilla.org
- Mozilla MFSA 2026-109 (Thunderbird 158) www.mozilla.org
- Mozilla Thunderbird known vulnerabilities www.mozilla.org
- Ubuntu security tracker CVE-2026-109780 ubuntu.com
- HKCERT security bulletin on Mozilla products www.hkcert.org
- HOL Guard CVE-2026-109780 hol.org
- Strix CVE-2026-109780 www.strix.ai
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 19:07.
Original description (NVD)
Mitigation bypass in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 158 and Thunderbird 158.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.