Sandbox Escape Vulnerability in Firefox by Mozilla
CVE-2026-109707

9.6CRITICAL

Key Information:

Vendor

Mozilla
Status
Firefox
Thunderbird
Vendor
CVE Published:
13 October 2026

What is CVE-2026-109707?

A vulnerability in the networking component of Firefox has been identified that allows for a sandbox escape due to a use-after-free flaw. This issue could potentially enable an attacker to execute arbitrary code outside the confines of the browser's security model. It was effectively patched in Firefox version 158 and Firefox ESR version 153.5, improving the overall security posture of the browser and its users. For more details, refer to Mozilla's advisories and bug reports.

Affected Version(s)

Firefox 153.5

Firefox 158

Thunderbird 153.5

References

https://bugzilla.mozilla.org/show_bug.cgi?id=2059150
https://www.mozilla.org/security/advisories/mfsa2026-106/
https://www.mozilla.org/security/advisories/mfsa2026-108/

CVSS V3.1

Score:
9.6
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Mozilla
.