CVE-2026-109705
CriticalCVSS 9.6Exploitation Probability (EPSS)
Low risk24th percentile - higher than 24% of all known CVEs
Summary
A vulnerability in the Networking component of Firefox and Thunderbird combines incorrect boundary conditions and use-after-free, leading to a sandbox escape and site isolation issue. It was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, Thunderbird 153.5, and Firefox ESR 115.44.
Risk Assessment
Broken site isolation and sandbox escape can let a malicious site access data from other sites and execute code on the system. This poses a serious threat to user data confidentiality and integrity.
Recommendation
Update the browser and mail client to the listed fixed versions. Consider enforcing updates through centralized software management.
Other vulnerabilities in Firefox and Thunderbird Networking component
See all- CVE-2026-109708Critical
A sandbox escape vulnerability in the Networking component of Firefox and Thunderbird is caused by incorrect boundary conditions. It was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, Thunderbird 153.5, and Firefox ESR 115.44.
- CVE-2026-109707Critical
A use-after-free vulnerability in the Networking component of Firefox and Thunderbird enables a sandbox escape. It was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, Thunderbird 153.5, and Firefox ESR 115.44.
Original NVD description (English source)
Sandbox escape, site isolation issue due to incorrect boundary conditions, use-after-free in the Networking component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, Thunderbird 153.5, and Firefox ESR 115.44.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS