CVE-2026-109737

—Unscored

Published 13 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash

—Unscored

Attack vector: —
Complexity: —
Privileges needed: —
User interaction: —
Impact: —
Weakness: —

Impact

Attackers can bypass Enterprise Policies enforcement in the browser. Execution context and prerequisite access depend on the specific policy bypassed.

Root cause

A mitigation bypass defect exists in the Enterprise Policies component.

Affected systems

Firefox prior to 158, Firefox ESR prior to 153.5, Thunderbird prior to 158, and Thunderbird ESR prior to 153.5.

Fix & remediation

Upgrade to Firefox 158, Firefox ESR 153.5, Thunderbird 158, or Thunderbird 153.5. No interim mitigations are listed in the advisory.

shell

$ sudo apt-get update && sudo apt-get install --only-upgrade firefox thunderbird

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

Mitigation bypass in the Enterprise Policies component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-109737