Sandbox Escape in Firefox Graphics Component
CVE-2026-109712

7.1HIGH

Key Information:

Vendor

Mozilla
Status
Firefox
Thunderbird
Vendor
CVE Published:
13 October 2026

What is CVE-2026-109712?

A vulnerability exists within the Graphics component of Firefox, allowing for a potential sandbox escape due to uninitialized memory. This issue has been addressed in various updated versions of the browser, specifically Firefox 158, Firefox ESR 115.43, and Firefox ESR 153.5. Users are advised to update to these versions to mitigate any risks associated with this vulnerability. More details can be found in the relevant Mozilla security advisories.

Affected Version(s)

Firefox 115.43

Firefox 153.5

Firefox 158

References

https://bugzilla.mozilla.org/show_bug.cgi?id=2068420
https://www.mozilla.org/security/advisories/mfsa2026-106/
https://www.mozilla.org/security/advisories/mfsa2026-107/

CVSS V3.1

Score:
7.1
Severity:
HIGH
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Mozilla
.