CVE-2026-109759

—Unscored

Published 13 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash

—Unscored

Attack vector: —
Complexity: —
Privileges needed: —
User interaction: —
Impact: —
Weakness: —

Impact

Attackers can bypass site isolation boundaries to access cross-origin data. Exploitation requires convincing a user to visit a malicious website or load hostile content.

Root cause

A site isolation flaw exists within the browser's Networking component.

Affected systems

Firefox prior to 158, Firefox ESR prior to 153.5, Thunderbird prior to 158, and Thunderbird ESR prior to 153.5.

Fix & remediation

Upgrade to Firefox 158, Firefox ESR 153.5, Thunderbird 158, or Thunderbird 153.5. No interim mitigation is provided, so patching the application is required.

shell

$ sudo apt-get update && sudo apt-get install --only-upgrade firefox thunderbird

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

Site isolation issue in the Networking component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-109759