{"id":"CVE-2026-109709","published":"2026-10-13T13:17:21.020","lastModified":"2026-10-14T04:18:16.497","description":"Information disclosure, privilege escalation in the Security: Process Sandboxing component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.","cvssScore":8.8,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cwes":["CWE-200"],"vendors":[],"products":[],"references":[{"url":"https://bugzilla.mozilla.org/show_bug.cgi?id=2067976","tags":[]},{"url":"https://www.mozilla.org/security/advisories/mfsa2026-106/","tags":[]},{"url":"https://www.mozilla.org/security/advisories/mfsa2026-108/","tags":[]},{"url":"https://www.mozilla.org/security/advisories/mfsa2026-109/","tags":[]},{"url":"https://www.mozilla.org/security/advisories/mfsa2026-110/","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"This vulnerability allows attackers to disclose sensitive information and escalate privileges within Firefox's process sandboxing component, potentially leading to full system compromise. The flaw enables unauthorized access to internal processes and data that should be isolated.","exploitability":"Exploitation requires a user interaction such as visiting a malicious website or opening a crafted email attachment, with no additional preconditions needed for successful exploitation.","blast_radius":"If exploited, this vulnerability could affect millions of Firefox users who browse the web or use Thunderbird email client, potentially leading to widespread data breaches and privilege escalation across affected systems.","remediation":"Upgrade to Firefox 158 or Thunderbird 158 immediately, as these versions contain the necessary fixes for this information disclosure and privilege escalation vulnerability.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["information-disclosure","privilege-escalation","browser"],"model":"garnet-coder","analyzedAt":"2026-10-16T09:03:53.749Z"}}