HighCVE-2026-109733

Mozilla Firefox und Thunderbrid: Mehrere Schwachstellen

Published 27.10.2026Sources: BSI

What is affected, what to do

JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.

Update Firefox to version 158, Firefox ESR to version 115.43, Thunderbird to version 153.5.

Affected: Debian Thunderbird 1:153.5.1esr-1~deb13u1..*
Debian Thunderbird 1:153.5.1esr-1~deb12u1..*
Debian Firefox-esr 153.5.0esr-1~deb12u1..*
Debian Firefox-esr 153.5.0esr-1~deb13u1..*

Not sure whether and how you are affected? Ask a question about this vulnerability

Metrics

8.1

Priority

XIEM Effective CVSS: highest available CVSS rating from NVD and vendor data.

Source: Vendor (CNA), CVSS v3

8.1

CVSS v3

Severity High on the scale from 0 to 10.

Source: BSI

0.5 %

EPSS score

Low — model estimates < 1% exploitation likelihood.

Source: FIRST EPSS, percentile 40.0

Show all metrics

Severity: High
Priority (0–325) The priority score is a consolidated metric that condenses several individual signals into a single, action-guiding ranking: technical severity (CVSS), exploitation likelihood (EPSS), known-exploited status (KEV) and the context of the affected asset. The aim is to answer the only truly important question in vulnerability management: what first? Read in glossary: 65.88 Methodology
Exploit maturity An exploit is code or a technique that specifically uses a concrete vulnerability to force unintended behaviour — such as executing code or escalating privileges. It is the tool that turns a theoretical flaw into a practical attack. Read in glossary: no public PoC known
XIEM Effective CVSS XIEM® is the tiered managed-security operating model from NEOSEC and a registered trademark of NEOSEC GmbH. It extends classic SIEM — the central collection, normalisation and correlation of security-relevant events — with endpoint forensics, network visibility and deception technology, and consolidates them into three building tiers: Sentry, Orchestrate and Command. Read in glossary: 8.1 Methodology
CVSS v3 CVSS is the globally established, open standard for assessing the technical severity of a vulnerability on a scale from 0 to 10. It describes how easily a flaw can be exploited and what damage it can cause — but not how likely its actual exploitation is. CVSS and the complementary EPSS deliberately answer different questions. Read in glossary: 8.1
EPSS score The EPSS score is the absolute model output for an individual vulnerability: the estimated probability of real-world exploitation within the next 30 days, expressed as a value between 0 and 1 (i.e. 0 % to 100 %). A score of 0.42 means „the model estimates a 42 % chance of real-world exploitation within 30 days“. Read in glossary: 0.5 %; Low — model estimates < 1% exploitation likelihood.
EPSS percentile The EPSS percentile is the relative position of a vulnerability within all EPSS-scored CVEs, expressed as a value between 0 and 1. A percentile of 0.90 means „this CVE has a higher EPSS score than 90 % of all other scored CVEs“. Unlike the EPSS score, it is not a probability — but a positioning within a ranking. Read in glossary: 40.0; High — this CVE ranks above the median of all CVEs scored today (rank ≥ 36%).
KEV status The KEV catalogue is a list maintained by the US authority CISA of vulnerabilities for which active exploitation in the wild has been confirmed. It answers not the question „how severe?“ but „is it already being attacked?“ — thereby sharply prioritising patching. Read in glossary: —
Published: 27.10.2026
CISA assessment (SSVC): Exploitation: none known · not automatable · Technical impact: total; Source: CISA Vulnrichment, as of 15 October 2026
CWE CWE is a catalogue of typical weakness types in software and hardware — such as flawed input validation, unsafe memory handling or poor authentication. Where a CVE names a concrete vulnerability in a concrete product, a CWE describes the underlying class of defect. Read in glossary: CWE-843

Detection rules

No NEOSEC detection rule is available for this vulnerability yet.

Classification under NIS2 and CRA

Rule-based classification from exploitation status and severity. It does not replace a case-by-case assessment.

NIS2 NIS2 is EU Directive (EU) 2022/2555 to raise the level of cybersecurity across the Union. It substantially broadens obligations compared with the first NIS directive: more sectors, mandatory risk management, staged reporting duties and personal accountability of senior management. Read in glossary: High technical severity: assess and remediate the vulnerability in vulnerability handling under Art. 21(2)(e) NIS2 and document the decision.
CRA The CRA is EU Regulation (EU) 2024/2847 setting horizontal cybersecurity requirements for „products with digital elements“ — from industrial controllers and software to connected consumer devices. For the first time manufacturers must ensure security across the entire product lifecycle, handle vulnerabilities and provide security updates. Read in glossary: From 11.12.2027, Annex I Part II CRA requires manufacturers of affected products with digital elements to handle vulnerabilities without delay and provide security updates.
ISO/IEC 27001 ISO/IEC 27001 is the internationally leading standard for an information security management system (ISMS). It describes a risk-based, process-oriented framework to systematically plan, implement, review and improve information security. Read in glossary: Control A.8.8, management of technical vulnerabilities: assess relevance to your systems, plan remediation and keep evidence.

Description

JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.

Source: BSI WID Portal

Affected products

The following versions are affected. Older releases of the same product line are also vulnerable unless stated otherwise.

Affected products
		Affected versions	Fixed in
Mozilla	Firefox	`< 158`	`158`
Mozilla	Firefox ESR	`< 115.43` `< 153.5`	`115.43` `153.5`
Mozilla	Thunderbird	`< 153.5` `< 158`	`153.5` `158`

From bundled advisories, not CVE-specific (5)

Product list of a bundled advisory that does not state which product this CVE affects.

Products from bundled advisories
		Affected versions	Fixed in
Mozilla	Firefox	`< 159`	`159`
Mozilla	Firefox ESR	`< 115.44` `< 153.6`	`115.44` `153.6`
Mozilla	Thunderbird	`< 153.6` `< 159`	`153.6` `159`

Vendors and products

Affected operating systems

Affected operating systems

Linux	debian	firefox-esr	`bookworm`
Linux	debian	firefox-esr	`trixie`
Linux	debian	thunderbird	`bookworm`
Linux	debian	thunderbird	`trixie`

Weakness classes (CWE)

CWE-843Access of Resource Using Incompatible Type ('Type Confusion')
Base
The product allocates or initializes a resource such as a pointer, object, or variable using one type, but it later accesses that resource using a type that is incompatible with the original type.
Entry at MITRE CWE-843

References & sources

bugzilla.mozilla.orgshow_bug.cgi?id=2068443
mozilla.orgsecurity/advisories/mfsa2026-106
mozilla.orgsecurity/advisories/mfsa2026-108
mozilla.orgsecurity/advisories/mfsa2026-109
mozilla.orgsecurity/advisories/mfsa2026-110
bugzilla.mozilla.orgshow_bug.cgi?id=2073692
mozilla.orgsecurity/advisories/mfsa2026-107
bugzilla.mozilla.orgshow_bug.cgi?id=2059150
mozilla.orgsecurity/advisories/mfsa2026-119
bugzilla.mozilla.orgshow_bug.cgi?id=2066094
bugzilla.mozilla.orgshow_bug.cgi?id=2076269
bugzilla.mozilla.orgshow_bug.cgi?id=2075998
bugzilla.mozilla.orgshow_bug.cgi?id=2071621
mozilla.orgsecurity/advisories/mfsa2026-122
bugzilla.mozilla.orgshow_bug.cgi?id=2070547
bugzilla.mozilla.orgshow_bug.cgi?id=2067174
bugzilla.mozilla.orgshow_bug.cgi?id=2037979
bugzilla.mozilla.orgshow_bug.cgi?id=2069765
bugzilla.mozilla.orgshow_bug.cgi?id=2072048
bugzilla.mozilla.orgshow_bug.cgi?id=2053649

Changes to this CVE

Who changed this CVE and when: NVD (analysis, affected products, CVSS), the CVE publisher (CNA) and additional providers such as CISA (ADP).

15.10.2026Record modifiedCISA ADP

CVSS V3.1: AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

CISA assessment (SSVC): exploitation: none known, automatable: no

Weakness type: CWE-843

Show 3 original changes

Individual changes of this event as published by NVD
Type	Action	Before	After
CVSS	added	—	AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Weakness type (CWE)	added	—	CWE-843
SSVC assessment	added	—	{"id":"CVE-2026-109733","role":"CISA Coordinator","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"version":"2.0.3","timestamp":"2026-10-15T19:23:24.897351Z"}

Source identifier: 134c704f-9b21-4f2e-91b3-4a467353bcc0

13.10.2026Record modifiedMozilla

Description added or changed

New references:

Show 4 original changes

Individual changes of this event as published by NVD
Type	Action	Before	After
Description	changed	JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, and Firefox ESR 153.5.	JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.
Affected versions (publisher)	added	—	Affected value modified. <a href="https://github.com/CVEProject/cvelistV5/blob/main/cves/2026/109xxx/CVE-2026-109733.json">CVE-2026-109733</a>
Reference	added	—	https://www.mozilla.org/security/advisories/mfsa2026-109/
Reference	added	—	https://www.mozilla.org/security/advisories/mfsa2026-110/

Source identifier: security@mozilla.org

13.10.2026ReceivedMozilla

Description added or changed

New references:

Show 6 original changes

Individual changes of this event as published by NVD
Type	Action	Before	After
Description	added	—	JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, and Firefox ESR 153.5.
Affected versions (publisher)	added	—	New affected value received. <a href="https://github.com/CVEProject/cvelistV5/blob/main/cves/2026/109xxx/CVE-2026-109733.json">CVE-2026-109733</a>
Reference	added	—	https://bugzilla.mozilla.org/show_bug.cgi?id=2076269
Reference	added	—	https://www.mozilla.org/security/advisories/mfsa2026-106/
Reference	added	—	https://www.mozilla.org/security/advisories/mfsa2026-107/
Reference	added	—	https://www.mozilla.org/security/advisories/mfsa2026-108/

Source identifier: security@mozilla.org

Linked CVEs

Linked CVEs

High	CVE-2026-110249	Denial-of-service in the Exchange email component	8.6	—
High	CVE-2026-110247	Integer overflow in libmime buffer growth could lead to heap corruption	8.4	—
High	CVE-2026-109783	Mitigation bypass in the File Handling component	8.3	—
High	CVE-2026-109782	Mitigation bypass in the File Handling component	8.3	—
Medium	CVE-2026-109781	Denial-of-service in the Printing: Output component	6.5	—
Critical	CVE-2026-109780	Mitigation bypass in the DOM: Core & HTML component	9.8	—
Medium	CVE-2026-109779	Race condition in the Networking: DNS component	4.2	—
High	CVE-2026-109778	Privilege escalation in the WebExtensions component	8.8	—
Medium	CVE-2026-109777	Information disclosure in the Storage: IndexedDB component	4.3	—
Medium	CVE-2026-109776	Race condition in the XPCOM component	4.2	—
Medium	CVE-2026-109775	Denial-of-service in the WebRTC component	6.5	—
Critical	CVE-2026-109774	Invalid pointer, undefined behavior in the DOM: Notifications component	9.8	—
Medium	CVE-2026-109773	Denial-of-service in the Sync component	6.5	—
Critical	CVE-2026-109772	Same-origin policy bypass in the DevTools component	9.1	—
Medium	CVE-2026-109771	Information disclosure in the WebRTC: Networking component	4.3	—
Medium	CVE-2026-109770	Spoofing issue in the DOM: Web Serial component	6.1	—
Medium	CVE-2026-109769	Information disclosure in the Networking: Cache component	4.3	—
Medium	CVE-2026-109768	Denial-of-service in the Site Reports component	6.5	—
Medium	CVE-2026-109767	Information disclosure in the Networking component	4.3	—
High	CVE-2026-109766	Mitigation bypass in the Enterprise Policies component	8.1	—
Medium	CVE-2026-109765	Race condition, use-after-free in the Graphics: Text component	4.2	—
Medium	CVE-2026-109764	Mitigation bypass in the Enterprise Policies component	5.4	—
Not rated	CVE-2026-109763	Mitigation bypass in the File Handling component	—	—
High	CVE-2026-109762	Incorrect boundary conditions in the SVG component	8.8	—

Show 57 more CVEs

Linked CVEs

Medium	CVE-2026-109761	Use-after-free in the JavaScript: WebAssembly component	5.4	—
High	CVE-2026-109760	Mitigation bypass in the Networking: HTTP component	8.1	—
High	CVE-2026-109759	Site isolation issue in the Networking component	8.1	—
High	CVE-2026-109757	Sandbox escape due to race condition in the Networking component	8.3	—
High	CVE-2026-109756	Privilege escalation in the DOM: Navigation component	8.8	—
Critical	CVE-2026-109755	Sandbox escape in the DOM: Content Processes component	9.6	—
High	CVE-2026-109754	Incorrect boundary conditions in the DOM: Editor component	8.1	—
High	CVE-2026-109753	Incorrect boundary conditions in the Layout component	8.1	—
Medium	CVE-2026-109752	Use-after-free in the DOM: Workers component	5.4	—
Medium	CVE-2026-109751	Information disclosure in the Networking component	4.3	—
Critical	CVE-2026-109750	Site isolation issue in the DOM: Web Authentication component	9.6	—
Medium	CVE-2026-109749	Use-after-free in the JavaScript: WebAssembly component	5.4	—
Medium	CVE-2026-109748	Use-after-free in the JavaScript: WebAssembly component	5.4	—
High	CVE-2026-109747	Other issue in the Address Bar component	7.3	—
High	CVE-2026-109746	Mitigation bypass in the DOM: Security component	7.3	—
Critical	CVE-2026-109745	Sandbox escape due to uninitialized memory in the DOM: Web Serial component	9.6	—
High	CVE-2026-109744	Other issue in the DOM: File component	8.1	—
High	CVE-2026-109743	Privilege escalation in the Panning and Zooming component	8.8	—
Medium	CVE-2026-109742	Information disclosure in the PDF Viewer component	4.3	—
Medium	CVE-2026-109741	Use-after-free in the Storage: Bucket File System component	5.4	—
Critical	CVE-2026-109740	Sandbox escape due to incorrect boundary conditions in the Widget: Win32 component	9.6	—
High	CVE-2026-109739	Privilege escalation in the WebExtensions component	8.8	—
Medium	CVE-2026-109738	Use-after-free in the Audio/Video: Playback component	5.4	—
High	CVE-2026-109737	Mitigation bypass in the Enterprise Policies component	8.1	—
High	CVE-2026-109736	Frame poisoning in the Layout component	8.1	—
Medium	CVE-2026-109735	Use-after-free in the DOM: Animation component	5.4	—
High	CVE-2026-109734	Mitigation bypass in the DOM: Security component	8.1	—
High	CVE-2026-109733	JIT miscompilation in the JavaScript Engine: JIT component	8.1	—
Medium	CVE-2026-109732	Use-after-free in the DOM: Streams component	5.4	—
Medium	CVE-2026-109731	Incorrect boundary conditions in the Graphics: Canvas2D component	5.4	—
High	CVE-2026-109730	Integer overflow in the Graphics component	8.8	—
Medium	CVE-2026-109729	Use-after-free in the JavaScript Engine: JIT component	5.4	—
Medium	CVE-2026-109728	Use-after-free in the DOM: Animation component	5.4	—
Medium	CVE-2026-109727	Use-after-free in the Audio/Video component	5.4	—
Medium	CVE-2026-109726	Use-after-free in the SVG component	5.4	—
Medium	CVE-2026-109725	Use-after-free in the DOM: Core & HTML component	5.4	—
Medium	CVE-2026-109724	Use-after-free in the DOM: Core & HTML component	5.4	—
Medium	CVE-2026-109723	Integer overflow in the Layout: Text and Fonts component	5.4	—
High	CVE-2026-109722	JIT miscompilation in the JavaScript Engine: JIT component	8.1	—
Medium	CVE-2026-109721	Incorrect boundary conditions in the JavaScript Engine: JIT component	5.4	—
High	CVE-2026-109720	JIT miscompilation in the JavaScript: WebAssembly component	7.1	—
Medium	CVE-2026-109719	Race condition, use-after-free in the Graphics: CanvasWebGL component	4.2	—
Medium	CVE-2026-109718	Use-after-free in the XML component	5.4	—
Medium	CVE-2026-109717	Use-after-free in the DOM: Bindings (WebIDL) component	5.4	—
High	CVE-2026-109716	Incorrect boundary conditions in the JavaScript Engine component	8.1	—
High	CVE-2026-109715	Incorrect boundary conditions in the JavaScript Engine component	8.1	—
Medium	CVE-2026-109714	Incorrect boundary conditions in the Layout component	5.4	—
Medium	CVE-2026-109713	Use-after-free in the Crash Reporting component	5.4	—
High	CVE-2026-109712	Sandbox escape due to uninitialized memory in the Graphics component	7.1	—
Medium	CVE-2026-109711	Use-after-free in the Graphics: Canvas2D component	5.4	—
Medium	CVE-2026-109710	Use-after-free in the Graphics: Text component	5.4	—
High	CVE-2026-109709	Information disclosure, privilege escalation in the Security: Process Sandboxing component	8.8	—
Critical	CVE-2026-109708	Sandbox escape due to incorrect boundary conditions in the Networking component	9.6	—
Critical	CVE-2026-109707	Sandbox escape due to use-after-free in the Networking component	9.6	—
Medium	CVE-2026-109706	Use-after-free in the Storage: IndexedDB component	5.4	—
Critical	CVE-2026-109705	Debian Thunderbird: Use After Free	9.6	—
High	CVE-2026-109704	Privilege escalation in the Application Update component	8.8	—

Embed badge

Show the severity and KEV status of this vulnerability on your site – with a link back here. The image is updated hourly.

<a href="https://intel.neosec.eu/en/cve/CVE-2026-109733"><img src="https://intel.neosec.eu/badge/cve/CVE-2026-109733.svg?lang=en" alt="CVE-2026-109733 – NEOSEC Intel" height="20"></a>