VDB
CVE-2026-109753
CVE-2026-109753
PUBLISHED
CVSS 8.1 HIGH
Reported by mozilla · Published October 13, 2026
Incorrect boundary conditions in the Layout component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.
Risk Scores
CVSS 3.1
8.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Mozilla | Firefox | 115.43, 153.5, 158 |
| Mozilla | Thunderbird | 153.5, 158 |
| Mozilla | Thunderbird | 153.5, 158 |
| chainguard | firefox-esr-140 | 0 |
| Mozilla | Firefox | 115.43, 153.5, 158 |
Timeline
- Oct 13, 2026 Coalition ESS Score
- Oct 13, 2026 CVE Published
- Oct 14, 2026 EPSS Score
- Oct 15, 2026 CVE Updated
- Oct 16, 2026 EPSS Score
- Oct 19, 2026 EPSS Score
- Oct 21, 2026 EPSS Score
- Oct 24, 2026 EPSS Score
- Oct 25, 2026 EPSS Score
- Oct 29, 2026 EPSS Score
- Oct 31, 2026 Distribution Patch
- Oct 31, 2026 Distribution Patch