CVE-2026-109750
9.6CriticalPublished 13 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
- Impact
- Full C/I/A compromise
- Weakness
- CWE-862
Impact
Remote attackers can break site isolation and compromise sensitive cross-origin data or resources if a user visits a malicious page. Exploitation requires convincing a user to load an attacker-controlled site in a vulnerable client.
Root cause
Missing authorization controls in the Web Authentication DOM component permit site isolation bypasses.
Affected systems
Firefox versions prior to 158 and Thunderbird versions prior to 158.
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Fix & remediation
Upgrade Firefox and Thunderbird to version 158 or later; no interim workaround is documented.
$ sudo apt-get update && sudo apt-get install --only-upgrade firefox thunderbirdAI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
Site isolation issue in the DOM: Web Authentication component. This vulnerability was fixed in Firefox 158 and Thunderbird 158.