CVE-2026-109770
UnknownSummary
Spoofing issue in the DOM: Web Serial component. Fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.
Risk Assessment
Spoofing could allow an attacker to impersonate trusted sources, potentially leading to fraud or data theft.
Recommendation
Update Firefox or Thunderbird to the specified version (158 or 153.5 ESR).
Other vulnerabilities in Firefox
See all- CVE-2026-109780Unknown
Vulnerability in the DOM: Core & HTML component allows mitigation bypass. This issue was fixed in Firefox 158 and Thunderbird 158.
- CVE-2026-109778High
A privilege escalation vulnerability in the WebExtensions component. It was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.
- CVE-2026-109777Medium
Information disclosure vulnerability in the Storage: IndexedDB component. This issue was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.
- CVE-2026-109776Unknown
Race condition vulnerability in the XPCOM component. Fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.
- CVE-2026-109775Medium
Denial-of-service vulnerability in the WebRTC component. This issue was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.
- CVE-2026-109774Unknown
Invalid pointer and undefined behavior in the DOM: Notifications component. Fixed in Firefox 158 and Thunderbird 158.
- CVE-2026-109773Medium
Denial-of-service vulnerability in the Sync component. This issue was fixed in Firefox 158 and Thunderbird 158.
- CVE-2026-109772Unknown
Same-origin policy bypass in the DevTools component. Fixed in Firefox 158 and Thunderbird 158.
- CVE-2026-109771Medium
Information disclosure vulnerability in the WebRTC: Networking component. This issue was fixed in Firefox 158 and Thunderbird 158.
- CVE-2026-109769Medium
Information disclosure vulnerability in the Networking: Cache component. This issue was fixed in Firefox 158 and Thunderbird 158.
Original NVD description (English source)
Spoofing issue in the DOM: Web Serial component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS