CVE-2026-109708

EUVD-2026-98485
Sandbox escape due to incorrect boundary conditions in the Networking component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
mozillaCNA
UNKNOWN
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 7.93%
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources.
VendorProductVersionSource
mozillafirefox
𝑥
< 158
CNA
mozillafirefox_esr
116.0.0 ≤
𝑥
< 153.5
CNA
mozillathunderbird
𝑥
< 158
CNA
mozillathunderbird_esr
𝑥
< 153.5
CNA
Debian logo
Debian Releases
Debian Product
Codename
firefox
sid
vulnerable
firefox-esr
bookworm
vulnerable
bookworm (security)
vulnerable
forky
vulnerable
sid
153.5.0esr-1
fixed
trixie
vulnerable
trixie (security)
153.5.0esr-1~deb13u1
fixed
thunderbird
bookworm
vulnerable
bookworm (security)
vulnerable
forky
vulnerable
sid
vulnerable
trixie
vulnerable
trixie (security)
vulnerable
Vulnerability Media Exposure
References
https://bugzilla.mozilla.org/show_bug.cgi?id=2059151
https://www.mozilla.org/security/advisories/mfsa2026-106/
https://www.mozilla.org/security/advisories/mfsa2026-108/
https://www.mozilla.org/security/advisories/mfsa2026-109/
https://www.mozilla.org/security/advisories/mfsa2026-110/