CVE-2026-109761
MediumCVSS 5.4Summary
Use-after-free vulnerability in the JavaScript: WebAssembly component of Firefox and Thunderbird. The flaw was fixed in Firefox 158 and Thunderbird 158.
Risk Assessment
Exploitation could cause application crashes or potentially arbitrary code execution. The risk affects organizations running vulnerable versions of Firefox or Thunderbird.
Recommendation
Update Firefox and Thunderbird to version 158. Given the nature of the flaw, apply the update urgently.
Other vulnerabilities in Firefox
See all- CVE-2026-109780Unknown
Vulnerability in the DOM: Core & HTML component allows mitigation bypass. This issue was fixed in Firefox 158 and Thunderbird 158.
- CVE-2026-109778High
A privilege escalation vulnerability in the WebExtensions component. It was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.
- CVE-2026-109777Medium
Information disclosure vulnerability in the Storage: IndexedDB component. This issue was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.
- CVE-2026-109776Unknown
Race condition vulnerability in the XPCOM component. Fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.
- CVE-2026-109775Medium
Denial-of-service vulnerability in the WebRTC component. This issue was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.
- CVE-2026-109774Unknown
Invalid pointer and undefined behavior in the DOM: Notifications component. Fixed in Firefox 158 and Thunderbird 158.
- CVE-2026-109773Medium
Denial-of-service vulnerability in the Sync component. This issue was fixed in Firefox 158 and Thunderbird 158.
- CVE-2026-109772Unknown
Same-origin policy bypass in the DevTools component. Fixed in Firefox 158 and Thunderbird 158.
- CVE-2026-109771Medium
Information disclosure vulnerability in the WebRTC: Networking component. This issue was fixed in Firefox 158 and Thunderbird 158.
- CVE-2026-109770Unknown
Spoofing issue in the DOM: Web Serial component. Fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.
Original NVD description (English source)
Use-after-free in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 158 and Thunderbird 158.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS