CVE-2026-109725 Mozilla CVE debrief

Who should care

Mozilla Firefox users and administrators should assess exposure to this vulnerability and prioritize patching. Affected systems should be verified for potential exploitation attempts and updated to the latest version to prevent exploitation. This vulnerability affects operators, platforms, and security teams who should review system inventory and monitor system logs.

Why it matters

Mozilla Firefox users should assess exposure to a use-after-free vulnerability in the DOM: Core & HTML component. Defenders should prioritize verification of affected systems and apply patches.

• Verify affected systems and apply patches to prevent potential exploitation
• Review system inventory for Firefox versions prior to 158, Firefox ESR 115.43, and Firefox ESR 153.5
• Monitor system logs for potential exploitation attempts

Technical summary

A use-after-free vulnerability exists in the DOM: Core & HTML component of Mozilla Firefox. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, and Firefox ESR 153.5. The vulnerability affects Mozilla Firefox users and administrators who should assess exposure and prioritize patching. The vulnerability allows for potential exploitation attempts, and defenders should prioritize verification of affected systems and apply patches. Limited technical details are available on the vulnerability's impact, but it is essential to review system inventory and monitor system logs.

Defensive priority

Defenders should prioritize verification of affected systems and apply patches.

Recommended defensive actions

• Verify affected systems and apply patches
• Review system inventory for Firefox versions prior to 158, Firefox ESR 115.43, and Firefox ESR 153.5
• Monitor system logs for potential exploitation attempts
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record and Mozilla advisories provide details on the vulnerability and fixed versions. Evidence of exploitation attempts should be verified through system logs and monitoring. The vulnerability was fixed in Firefox 158, Firefox ESR 115.43, and Firefox ESR 153.5. Limited evidence is available on the vulnerability's impact, but defenders should prioritize verification of affected systems and apply patches.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.