CERTFR-2026-AVI-1305

FrançaisShown in its original language — a full translation is planned for a future version.

Multiples vulnérabilités dans les produits Mozilla

view advisory published 2026-10-14

A published security advisory; the vulnerabilities below are the ones it describes.

describes (82)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2026-110249US	—	0.18% (7th)	—	2026-10-13
A malicious, compromised, or MITM-controlled Exchange server can return a single well-formed SOAP response containing an element with enough attributes to keep Thunderbird's main t…
CVE-2026-110247US	—	0.17% (7th)	—	2026-10-13
Several buffer-growth sites in libmime performed size arithmetic in 32-bit types without overflow checks. On a sufficiently large message the growth guard could fail open, or the b…
CVE-2026-109783US	—	0.27% (20th)	—	2026-10-13
Mitigation bypass in the File Handling component. This vulnerability was fixed in Firefox ESR 153.5 and Thunderbird 153.5.
CVE-2026-109782US	—	0.27% (20th)	—	2026-10-13
Mitigation bypass in the File Handling component. This vulnerability was fixed in Firefox ESR 153.5 and Thunderbird 153.5.
CVE-2026-109781US	—	0.25% (16th)	—	2026-10-13
Denial-of-service in the Printing: Output component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.
CVE-2026-109780US	—	0.36% (30th)	—	2026-10-13
Mitigation bypass in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 158 and Thunderbird 158.
CVE-2026-109779US	—	0.14% (3rd)	—	2026-10-13
Race condition in the Networking: DNS component. This vulnerability was fixed in Firefox 158 and Thunderbird 158.
CVE-2026-109778US	—	0.28% (20th)	—	2026-10-13
Privilege escalation in the WebExtensions component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.
CVE-2026-109777US	—	0.21% (11th)	—	2026-10-13
Information disclosure in the Storage: IndexedDB component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.
CVE-2026-109776US	—	0.14% (4th)	—	2026-10-13
Race condition in the XPCOM component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.
CVE-2026-109775US	—	0.25% (16th)	—	2026-10-13
Denial-of-service in the WebRTC component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.
CVE-2026-109774US	—	0.34% (28th)	—	2026-10-13
Invalid pointer, undefined behavior in the DOM: Notifications component. This vulnerability was fixed in Firefox 158 and Thunderbird 158.
CVE-2026-109773US	—	0.24% (15th)	—	2026-10-13
Denial-of-service in the Sync component. This vulnerability was fixed in Firefox 158 and Thunderbird 158.
CVE-2026-109772US	—	0.18% (8th)	—	2026-10-13
Same-origin policy bypass in the DevTools component. This vulnerability was fixed in Firefox 158 and Thunderbird 158.
CVE-2026-109771US	—	0.20% (10th)	—	2026-10-13
Information disclosure in the WebRTC: Networking component. This vulnerability was fixed in Firefox 158 and Thunderbird 158.
CVE-2026-109770US	—	0.19% (8th)	—	2026-10-13
Spoofing issue in the DOM: Web Serial component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.
CVE-2026-109769US	—	0.20% (10th)	—	2026-10-13
Information disclosure in the Networking: Cache component. This vulnerability was fixed in Firefox 158 and Thunderbird 158.
CVE-2026-109768US	—	0.24% (15th)	—	2026-10-13
Denial-of-service in the Site Reports component. This vulnerability was fixed in Firefox 158 and Thunderbird 158.
CVE-2026-109767US	—	0.21% (11th)	—	2026-10-13
Information disclosure in the Networking component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.
CVE-2026-109766US	—	0.34% (27th)	—	2026-10-13
Mitigation bypass in the Enterprise Policies component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.

showing 20 of 82

references

External citations — patches, advisories, analysis.

CERT-FR advisory

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan