CVE-2026-109725
5.4MediumPublished 13 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
- Impact
- Limited impact
- Weakness
- CWE-416
Impact
Remote attackers can potentially manipulate browser memory or execute arbitrary code if a user visits a malicious webpage or opens a crafted email. The attack requires user interaction with untrusted web or email content.
Root cause
A use-after-free bug occurs in the DOM Core and HTML component during web content processing.
Affected systems
Firefox versions prior to 158, Firefox ESR prior to 115.43, Firefox ESR prior to 153.5, Thunderbird prior to 158, and Thunderbird prior to 153.5.
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
Fix & remediation
Upgrade to Firefox 158, Firefox ESR 115.43, Firefox ESR 153.5, Thunderbird 158, or Thunderbird 153.5. No interim mitigations are specified; patching the client applications is required.
$ sudo apt-get update && sudo apt-get install --only-upgrade firefox thunderbirdAI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.
References
- https://bugzilla.mozilla.org/show_bug.cgi?id=2074208
- https://www.mozilla.org/security/advisories/mfsa2026-106/
- https://www.mozilla.org/security/advisories/mfsa2026-107/
- https://www.mozilla.org/security/advisories/mfsa2026-108/
- https://www.mozilla.org/security/advisories/mfsa2026-109/
- https://www.mozilla.org/security/advisories/mfsa2026-110/