Mozilla Firefox ESR and Thunderbird: Mitigation bypass in File Handling
Summary
A mitigation bypass in the File Handling component of Mozilla Firefox ESR and Thunderbird allows security protections to be circumvented. Successful exploitation requires user interaction, such as opening a crafted page or file, and it is not network-only in the sense of unattended attack. The CVSS 3.1 base score is 8.3 (High) with high impact on confidentiality, integrity and availability. CISA SSVC lists no known exploitation and no automation.
Affected
- Mozilla Firefox ESR before 153.5
- Mozilla Thunderbird before 153.5
Fixed in
- Mozilla Firefox ESR 153.5
- Mozilla Thunderbird 153.5
- Later releases are also available; use the latest 153.x build.
Workaround
Unknown.
Exploitation
- No known exploitation at the time of research.
- CISA SSVC: Exploitation none, Automatable no, Technical Impact total.
Our recommendation
- Update Firefox ESR and Thunderbird to the latest 153.x release (at least 153.5) on all systems, including Windows and Linux.
- Check that distribution packages (Ubuntu, Red Hat, SUSE, Debian) contain the fixed build.
- Patch the whole Mozilla batch of October 2026, which also contains several sandbox escapes and use-after-free bugs.
- Monitor the NVD and CISA KEV status for changes.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Mozilla Foundation Security Advisory MFSA 2026-108 (Firefox ESR 153.5) www.mozilla.org
- Mozilla Foundation Security Advisory MFSA 2026-110 (Thunderbird 153.5) www.mozilla.org
- Ubuntu Security Notice CVE-2026-109782 ubuntu.com
- Mozilla Bugzilla bug 2067465 bugzilla.mozilla.org
- Tenable Nessus plugin 365313 (Firefox ESR < 153.5) www.tenable.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 13:53.
Original description (NVD)
Mitigation bypass in the File Handling component. This vulnerability was fixed in Firefox ESR 153.5 and Thunderbird 153.5.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.