CVE-2026-109767

4.3Medium

Published 13 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash

4.3Medium

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: Required
Impact: Limited impact
Weakness: CWE-200

Impact

Remote attackers can read sensitive network-related data if they trick a user into interacting with malicious content. The attacker needs no privileges, but user interaction is required.

Root cause

An information disclosure flaw exists in the Mozilla Networking component.

Affected systems

Firefox versions prior to 158, Firefox ESR prior to 153.5, Thunderbird prior to 158, and Thunderbird prior to 153.5.

CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

Fix & remediation

Upgrade to Firefox 158, Firefox ESR 153.5, Thunderbird 158, or Thunderbird 153.5; no interim workarounds are documented.

shell

$ sudo apt-get update && sudo apt-get install --only-upgrade firefox thunderbird

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

Information disclosure in the Networking component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-109767