CVE-2026-109751

4.3Medium

Published 13 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash

4.3Medium

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: Required
Impact: Limited impact
Weakness: CWE-200

Impact

Remote attackers can read sensitive network-level information if a user is tricked into visiting a malicious site or opening malicious content. The attacker gains unauthorized data read access without execution privileges.

Root cause

An information disclosure flaw exists in the Mozilla Networking component.

Affected systems

Firefox prior to 158, Firefox ESR prior to 153.5, Thunderbird prior to 158, and Thunderbird ESR prior to 153.5.

CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

Fix & remediation

Upgrade to Firefox 158, Firefox ESR 153.5, Thunderbird 158, or Thunderbird 153.5. No interim workarounds or mitigations are provided; applying the package update is required.

shell

$ sudo apt-get update && sudo apt-get install --only-upgrade firefox thunderbird

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

Information disclosure in the Networking component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-109751