CVE-2026-109768
MediumCVSS 6.5Summary
Denial-of-service vulnerability in the Site Reports component. This issue was fixed in Firefox 158 and Thunderbird 158.
Risk Assessment
It may cause the site reports feature to become unavailable, disrupting browser or mail client operation.
Recommendation
Update Firefox and Thunderbird to version 158.
Other vulnerabilities in Firefox
See all- CVE-2026-109780Unknown
Vulnerability in the DOM: Core & HTML component allows mitigation bypass. This issue was fixed in Firefox 158 and Thunderbird 158.
- CVE-2026-109778High
A privilege escalation vulnerability in the WebExtensions component. It was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.
- CVE-2026-109777Medium
Information disclosure vulnerability in the Storage: IndexedDB component. This issue was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.
- CVE-2026-109776Unknown
Race condition vulnerability in the XPCOM component. Fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.
- CVE-2026-109775Medium
Denial-of-service vulnerability in the WebRTC component. This issue was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.
- CVE-2026-109774Unknown
Invalid pointer and undefined behavior in the DOM: Notifications component. Fixed in Firefox 158 and Thunderbird 158.
- CVE-2026-109773Medium
Denial-of-service vulnerability in the Sync component. This issue was fixed in Firefox 158 and Thunderbird 158.
- CVE-2026-109772Unknown
Same-origin policy bypass in the DevTools component. Fixed in Firefox 158 and Thunderbird 158.
- CVE-2026-109771Medium
Information disclosure vulnerability in the WebRTC: Networking component. This issue was fixed in Firefox 158 and Thunderbird 158.
- CVE-2026-109770Unknown
Spoofing issue in the DOM: Web Serial component. Fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.
Original NVD description (English source)
Denial-of-service in the Site Reports component. This vulnerability was fixed in Firefox 158 and Thunderbird 158.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS