‹ Back to list

CVE-2026-109740

Status: DeferredCritical (9.6)—
Severity9.6Critical · CVSS 3.1
Exploitation probability0.35 %higher than 27% of CVEs
Active exploitationNonot in the CISA catalog
Public exploitNot knownno public code found

Sandbox escape due to incorrect boundary conditions in the Widget: Win32 component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.

CVSS

Base score
9.6
Version
3.1
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Exploitation probability (EPSS)

Probability of exploitation in the next 30 days
0.35 %
Percentile among all scored CVEs
27
Score date
10/21/2026

EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).

ATT&CK techniques

How this vulnerability is exploited and what the attacker gains, in MITRE ATT&CK terms.

Vector AV:N/PR:N/UI:R: requiere que la víctima abra contenido en Firefox/Thunderbird. La descripción de escape del sandbox no nombra comandos ni intérprete concreto, por lo que la ejecución es inferida.

Inferred by our analysis agent from the official description, CVSS vector and CWE, and checked by a supervisor. May contain errors.

ATT&CK mitigations that cover these techniques

Application Isolation and SandboxingExploit ProtectionUpdate Software

Affected technologies (1)

⚠ AI-inferred from the description — NVD hasn't analyzed this CVE yet, these aren't verified CPEs.

Mozilla — FirefoxAI

CWEs

References

Show 5 references

Raw JSON (NVD)

Show
{
  "id": "CVE-2026-109740",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-109740",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-10-19T11:51:05.678002Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 9.6,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 6,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "security@mozilla.org",
      "affectedData": [
        {
          "vendor": "Mozilla",
          "product": "Firefox",
          "versions": [
            {
              "status": "unaffected",
              "version": "153.5",
              "versionType": "rpm",
              "lessThanOrEqual": "153.*"
            },
            {
              "status": "unaffected",
              "version": "158",
              "versionType": "rpm",
              "lessThanOrEqual": "*"
            }
          ]
        },
        {
          "vendor": "Mozilla",
          "product": "Thunderbird",
          "versions": [
            {
              "status": "unaffected",
              "version": "153.5",
              "versionType": "rpm",
              "lessThanOrEqual": "153.*"
            },
            {
              "status": "unaffected",
              "version": "158",
              "versionType": "rpm",
              "lessThanOrEqual": "*"
            }
          ]
        }
      ]
    }
  ],
  "published": "2026-10-13T13:17:24.587",
  "references": [
    {
      "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2057113",
      "source": "security@mozilla.org"
    },
    {
      "url": "https://www.mozilla.org/security/advisories/mfsa2026-106/",
      "source": "security@mozilla.org"
    },
    {
      "url": "https://www.mozilla.org/security/advisories/mfsa2026-108/",
      "source": "security@mozilla.org"
    },
    {
      "url": "https://www.mozilla.org/security/advisories/mfsa2026-109/",
      "source": "security@mozilla.org"
    },
    {
      "url": "https://www.mozilla.org/security/advisories/mfsa2026-110/",
      "source": "security@mozilla.org"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "description": [
        {
          "lang": "en",
          "value": "CWE-119"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Sandbox escape due to incorrect boundary conditions in the Widget: Win32 component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5."
    }
  ],
  "lastModified": "2026-10-19T12:16:59.840",
  "sourceIdentifier": "security@mozilla.org"
}