CVE-2026-109708

CRITICALCVSS 9.6

Description

Sandbox escape due to incorrect boundary conditions in the Networking component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.

Timeline

Published:October 13th, 2026 1:17 PM

Last modified:October 15th, 2026 8:17 PM

CVSS Scoring

CVSS v3: 9.6 (CRITICAL)

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Weaknesses (CWE)

CWE-119

References & Reports

Advisories, patches, and third-party reports

https://bugzilla.mozilla.org/show_bug.cgi?id=2059151
https://www.mozilla.org/security/advisories/mfsa2026-106/
https://www.mozilla.org/security/advisories/mfsa2026-108/
https://www.mozilla.org/security/advisories/mfsa2026-109/
https://www.mozilla.org/security/advisories/mfsa2026-110/

Source: NIST NVD · Data may lag official sources by up to one minute