VDB
CVE-2026-109759
CVE-2026-109759
PUBLISHED
CVSS 8.1 HIGH
Reported by mozilla · Published October 13, 2026
Site isolation issue in the Networking component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.
Risk Scores
CVSS 3.1
8.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Mozilla | Firefox | 153.5, 158 |
| Mozilla | Thunderbird | 153.5, 158 |
| Mozilla | Firefox | 153.5, 158 |
| chainguard | firefox-esr-140 | 0 |
| Mozilla | Thunderbird | 153.5, 158 |
Timeline
- Oct 13, 2026 Coalition ESS Score
- Oct 13, 2026 CVE Published
- Oct 14, 2026 EPSS Score
- Oct 16, 2026 EPSS Score
- Oct 19, 2026 CVE Updated
- Oct 20, 2026 EPSS Score
- Oct 25, 2026 EPSS Score
- Oct 31, 2026 Distribution Patch
- Oct 31, 2026 Security Advisory