{"id":"CVE-2026-109739","published":"2026-10-13T13:17:24.480","lastModified":"2026-10-14T16:17:37.327","description":"Privilege escalation in the WebExtensions component. This vulnerability was fixed in Firefox 158 and Thunderbird 158.","cvssScore":8.8,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-269"],"vendors":[],"products":[],"references":[{"url":"https://bugzilla.mozilla.org/show_bug.cgi?id=2049069","tags":[]},{"url":"https://www.mozilla.org/security/advisories/mfsa2026-106/","tags":[]},{"url":"https://www.mozilla.org/security/advisories/mfsa2026-109/","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"A privilege escalation vulnerability in Firefox and Thunderbird's WebExtensions component allows authenticated users to gain elevated privileges, potentially leading to full system compromise. This affects both browsers and email clients from version 158 and earlier.","exploitability":"Exploitation requires an authenticated user session with access to the WebExtensions API, making it moderately difficult but possible with social engineering or compromised accounts.","blast_radius":"If exploited, this vulnerability could allow attackers to execute arbitrary code with elevated privileges, potentially leading to complete system compromise across multiple platforms including Windows, macOS, and Linux.","remediation":"Upgrade to Firefox 158 or Thunderbird 158 immediately, as these versions contain the necessary patches for this privilege escalation vulnerability.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["privilege-escalation","webextensions","browser"],"model":"garnet-coder","analyzedAt":"2026-10-16T09:04:05.673Z"}}