CVE-2026-109705
CriticalCVSS 9.6Summary
Sandbox escape, site isolation issue due to incorrect boundary conditions, use-after-free in the Networking component. This vulnerability was fixed in Firefox 158 and Firefox ESR 153.5.
Risk Assessment
The risk includes potential sandbox escape and site isolation bypass, which could lead to code execution and data disclosure across sites.
Recommendation
Immediately update Firefox to version 158 or Firefox ESR 153.5 or later.
Other vulnerabilities in Firefox
See all- CVE-2026-109781Medium
Denial-of-service in the Printing: Output component. This vulnerability was fixed in Firefox 158 and Firefox ESR 153.5.
- CVE-2026-109780Unknown
Mitigation bypass in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 158.
- CVE-2026-109779Medium
Race condition in the Networking: DNS component. This vulnerability was fixed in Firefox 158.
- CVE-2026-109778High
Privilege escalation in the WebExtensions component. This vulnerability was fixed in Firefox 158 and Firefox ESR 153.5.
- CVE-2026-109777Medium
Information disclosure in the Storage: IndexedDB component. This vulnerability was fixed in Firefox 158 and Firefox ESR 153.5.
- CVE-2026-109776Unknown
Race condition in the XPCOM component. This vulnerability was fixed in Firefox 158 and Firefox ESR 153.5.
- CVE-2026-109775Medium
Denial-of-service in the WebRTC component. This vulnerability was fixed in Firefox 158 and Firefox ESR 153.5.
- CVE-2026-109774Unknown
Invalid pointer, undefined behavior in the DOM: Notifications component. This vulnerability was fixed in Firefox 158.
- CVE-2026-109773Medium
Denial-of-service in the Sync component. This vulnerability was fixed in Firefox 158.
- CVE-2026-109772Unknown
Same-origin policy bypass in the DevTools component. This vulnerability was fixed in Firefox 158.
Original NVD description (English source)
Sandbox escape, site isolation issue due to incorrect boundary conditions, use-after-free in the Networking component. This vulnerability was fixed in Firefox 158 and Firefox ESR 153.5.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS