CVE-2026-109746

7.3High

Published 13 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash

7.3High

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None
Impact: Limited impact
Weakness: CWE-693

Impact

Remote attackers can bypass DOM security controls over the network without authentication. This weakens browser security boundaries, potentially facilitating unauthorized read, modification, or disruption of web contexts.

Root cause

A protection mechanism failure in the DOM: Security component bypasses intended browser mitigations.

Affected systems

Firefox versions prior to 158 and Thunderbird versions prior to 158.

CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Fix & remediation

Upgrade Firefox to 158 or later, and Thunderbird to 158 or later. No interim workaround is documented.

shell

$ sudo apt-get update && sudo apt-get install --only-upgrade firefox thunderbird

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

Mitigation bypass in the DOM: Security component. This vulnerability was fixed in Firefox 158 and Thunderbird 158.

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-109746