CVE-2026-109745

9.6Critical

Published 13 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash

9.6Critical

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: Required
Impact: Full C/I/A compromise
Weakness: CWE-908

Impact

Remote attackers can break out of the browser sandbox to execute arbitrary code with full system privileges. Exploitation requires convincing a user to visit a malicious website or view malicious content.

Root cause

The DOM Web Serial component uses uninitialized memory, leading to memory corruption and sandbox escape.

Affected systems

Firefox prior to 158, Firefox ESR prior to 153.5, Thunderbird prior to 158, and Thunderbird ESR prior to 153.5.

CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Fix & remediation

Upgrade Firefox to version 158 or ESR 153.5, and Thunderbird to version 158 or ESR 153.5. No interim configuration mitigation is specified, so prioritize patching immediately.

shell

$ sudo apt-get update && sudo apt-get install --only-upgrade firefox thunderbird

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

Sandbox escape due to uninitialized memory in the DOM: Web Serial component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-109745