CVE-2026-109715
8.1HighPublished 13 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
- Impact
- High impact on confidentiality, integrity
- Weakness
- CWE-119
Impact
Remote attackers can read and write arbitrary memory within the browser process if a user visits a malicious page or opens an untrusted message. Exploitation requires user interaction to load attacker-controlled JavaScript.
Root cause
Improper boundary checking in the JavaScript engine memory operations.
Affected systems
Firefox before 158, Firefox ESR before 115.43, Firefox ESR before 153.5, Thunderbird before 158, and Thunderbird before 153.5.
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Fix & remediation
Upgrade to Firefox 158, Firefox ESR 115.43, Firefox ESR 153.5, Thunderbird 158, or Thunderbird 153.5. No interim mitigation is documented, so prioritize patching immediately.
$ sudo apt-get update && sudo apt-get install --only-upgrade firefox thunderbirdAI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
Incorrect boundary conditions in the JavaScript Engine component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.
References
- https://bugzilla.mozilla.org/show_bug.cgi?id=2073267
- https://www.mozilla.org/security/advisories/mfsa2026-106/
- https://www.mozilla.org/security/advisories/mfsa2026-107/
- https://www.mozilla.org/security/advisories/mfsa2026-108/
- https://www.mozilla.org/security/advisories/mfsa2026-109/
- https://www.mozilla.org/security/advisories/mfsa2026-110/