CVE-2026-109771

4.3Medium

Published 13 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash

4.3Medium

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: Required
Impact: Limited impact
Weakness: CWE-200

Impact

Remote attackers can read sensitive local information if a user is tricked into visiting a malicious site or viewing malicious content. Exploitation requires user interaction over the network.

Root cause

An information disclosure flaw exists within the WebRTC networking component.

Affected systems

Firefox versions prior to 158 and Thunderbird versions prior to 158.

CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

Fix & remediation

Upgrade Firefox and Thunderbird to version 158 or later. If upgrading must wait, disable WebRTC in Firefox by setting media.peerconnection.enabled to false in about:config.

shell

$ sudo apt-get update && sudo apt-get install --only-upgrade firefox thunderbird

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

Information disclosure in the WebRTC: Networking component. This vulnerability was fixed in Firefox 158 and Thunderbird 158.

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-109771