CVE-2026-109783
—UnscoredPublished 13 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash
- Attack vector
- —
- Complexity
- —
- Privileges needed
- —
- User interaction
- —
- Impact
- —
- Weakness
- —
Impact
Attackers can bypass file handling security mitigations, potentially enabling unauthorized file execution or access if a user is tricked into interacting with malicious content. Exploitation requires user interaction with a malicious file or link.
Root cause
A flaw in the File Handling component allows an attacker to bypass existing security mitigations.
Affected systems
Firefox ESR prior to 153.5 and Thunderbird prior to 153.5.
Fix & remediation
Upgrade to Firefox ESR 153.5 and Thunderbird 153.5 or later. No temporary configuration workaround is provided.
$ sudo apt-get update && sudo apt-get --only-upgrade install firefox-esr thunderbirdAI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
Mitigation bypass in the File Handling component. This vulnerability was fixed in Firefox ESR 153.5 and Thunderbird 153.5.