Sandbox Escape Vulnerability in Mozilla Firefox Networking Component
CVE-2026-109708

9.6CRITICAL

Key Information:

Vendor

Mozilla
Status
Firefox
Thunderbird
Vendor
CVE Published:
13 October 2026

What is CVE-2026-109708?

A sandbox escape vulnerability was identified in the Networking component of Mozilla Firefox due to incorrect boundary conditions. This flaw allows malicious entities to bypass security restrictions, potentially leading to unauthorized access to sensitive data or resources. The issue has been addressed in Firefox version 158 and Firefox ESR 153.5, emphasizing the need for users to update their browsers promptly to safeguard against potential exploits.

Affected Version(s)

Firefox 153.5

Firefox 158

Thunderbird 153.5

References

https://bugzilla.mozilla.org/show_bug.cgi?id=2059151
https://www.mozilla.org/security/advisories/mfsa2026-106/
https://www.mozilla.org/security/advisories/mfsa2026-108/

CVSS V3.1

Score:
9.6
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Mozilla
.