{"id":"CVE-2026-109704","published":"2026-10-13T13:17:20.473","lastModified":"2026-10-14T16:17:37.183","description":"Privilege escalation in the Application Update component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.","cvssScore":8.8,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-269"],"vendors":[],"products":[],"references":[{"url":"https://bugzilla.mozilla.org/show_bug.cgi?id=2037979","tags":[]},{"url":"https://www.mozilla.org/security/advisories/mfsa2026-106/","tags":[]},{"url":"https://www.mozilla.org/security/advisories/mfsa2026-108/","tags":[]},{"url":"https://www.mozilla.org/security/advisories/mfsa2026-109/","tags":[]},{"url":"https://www.mozilla.org/security/advisories/mfsa2026-110/","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"This vulnerability allows attackers with limited privileges to escalate their access within the Application Update component, potentially gaining full system control. The flaw stems from improper privilege handling in how updates are processed.","exploitability":"Exploitation requires a user with low privileges to interact with the update process, making it moderately difficult but not impossible to achieve privilege escalation.","blast_radius":"If exploited, this vulnerability could allow attackers to gain full system access through the update mechanism, affecting all users running vulnerable versions of Firefox or Thunderbird.","remediation":"Upgrade to Firefox 158 or Thunderbird 158 to remediate this privilege escalation vulnerability.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["privilege-escalation","update-component","firefox","thunderbird"],"model":"garnet-coder","analyzedAt":"2026-10-16T09:03:47.864Z"}}