Mozilla fixes two critical Firefox 158 flaws that allow attackers to escape the browser sandbox
Mozilla has released Firefox 158 and Firefox ESR 153.5 to fix, among other issues, two critical vulnerabilities (CVE-2026-109705 and CVE-2026-109707) in the networking component that allow an attacker to break out of the browser sandbox simply by getting a user to visit a malicious page. Any machine running Firefox is affected.
What happened
Mozilla has published advisory MFSA2026-106, dated 13 October 2026, listing the security issues fixed in Firefox 158. Two of them stand out: NVD rates both as critical, with a CVSS score of 9.6 out of 10.
CVE-2026-109705 combines a site isolation problem caused by incorrect boundary conditions with a use-after-free in the networking component, allowing an attacker to escape the browser sandbox. CVE-2026-109707 is also a sandbox escape, caused by a use-after-free in that same networking component.
The sandbox is the barrier that stops web page content from interacting with the rest of the operating system. If it is broken, an attacker controlling a malicious website could run code outside that isolation. According to the CVSS vector, the attack is launched over the network, requires no prior privileges and does need user interaction: the victim only has to open a crafted page. The impact on confidentiality, integrity and availability is high.
One discrepancy is worth noting: Mozilla rates both bugs as high impact in its advisory, while NVD assigns them a critical 9.6 score. Either way, the advice is the same: update as soon as practical.
Who is affected
This affects Firefox users on any platform and, in the case of CVE-2026-109705, Firefox ESR as well, the extended support release that many organisations deploy under central management. Some of the product labels are inferred from the vulnerability description, so it is worth verifying the versions actually installed across your estate.
- Firefox: fixed in version 158.
- Firefox ESR: fixed in version 153.5.
- This update follows the fix released on 8 October in Firefox 157.0.1 (CVE-2026-106016).
Exploitation status
Neither vulnerability appears in CISA's KEV catalogue, meaning there is no confirmed active exploitation, and no public exploit code is known. Neither has an EPSS score yet, so there is no estimate of how likely exploitation is in the short term.
The technical detail for CVE-2026-109705 sits in a restricted Bugzilla report, a common Mozilla practice to limit available information until the patch is widely deployed. Even so, sandbox escapes are highly attractive targets and are often analysed quickly once a patch ships.
What to do
The update is straightforward and should be prioritised over the coming days; an emergency window is not warranted unless exploitation is observed.
- Update Firefox to version 158 and Firefox ESR to version 153.5.
- Check that Firefox automatic updates are enabled and that the browser is restarted so the patch takes effect: on many machines the download completes but the fix is not active until a restart.
- In managed environments, review any enterprise policies that may be delaying updates and push the new version through your usual deployment tooling.
- Inventory any devices still running versions earlier than 158 (or 153.5 for ESR) and track them until the rollout is complete.
Sources
Affected technologies
Vulnerabilities (2)
| CVE | Severity | Active exploitation | Published | NVD status |
|---|---|---|---|---|
| CVE-2026-109705 | Critical (9.6) | — | 10/13/2026 | Deferred |
| CVE-2026-109707 | Critical (9.6) | — | 10/13/2026 | Deferred |
Written automatically from NVD, CISA KEV and vendor advisory data. Always check affected versions and patches in the vendor's official advisory before acting.