VDB
CVE-2026-109776
CVE-2026-109776
PUBLISHED
CVSS 4.2 MEDIUM
Reported by mozilla · Published October 13, 2026
Race condition in the XPCOM component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.
Risk Scores
CVSS 3.1
4.2
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Mozilla | Firefox | 153.5, 158 |
| Mozilla | Thunderbird | 153.5, 158 |
| Mozilla | Thunderbird | 153.5, 158 |
| chainguard | firefox-esr-140 | 0 |
| Mozilla | Firefox | 153.5, 158 |
Timeline
- Oct 13, 2026 Coalition ESS Score
- Oct 13, 2026 CVE Published
- Oct 14, 2026 EPSS Score
- Oct 15, 2026 CVE Updated
- Oct 16, 2026 EPSS Score
- Oct 25, 2026 EPSS Score