CVE-2026-109708

critical

Description

Sandbox escape due to incorrect boundary conditions in the Networking component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, Thunderbird 153.5, and Firefox ESR 115.44.

References

https://www.mozilla.org/security/advisories/mfsa2026-119/

https://www.mozilla.org/security/advisories/mfsa2026-110/

https://www.mozilla.org/security/advisories/mfsa2026-109/

https://www.mozilla.org/security/advisories/mfsa2026-108/

https://www.mozilla.org/security/advisories/mfsa2026-106/

https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-98485

https://bugzilla.mozilla.org/show_bug.cgi?id=2059151

Details

Source: Mitre, NVD

Published: 2026-10-13

Updated: 2026-10-27

Named Vulnerability: GHSA-589f-33q5-grw7

Risk Information

CVSS v2

Base Score: 10

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

Severity: Critical

CVSS v3

Base Score: 9.6

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H