CVE-2026-109768 Mozilla CVE debrief

Who should care

Defenders responsible for managing Firefox and Thunderbird installations should assess exposure and prioritize verification of inventory and remediation to prevent potential denial-of-service attacks.

Why it matters

CVE-2026-109768 is a denial-of-service vulnerability in the Site Reports component of Firefox and Thunderbird. Defenders should assess exposure, particularly for systems using these products, and prioritize verification of inventory and remediation.

• Denial-of-service attacks could disrupt service availability
• Verification of inventory and remediation is required to prevent exploitation
• Firefox and Thunderbird users should update to version 158 or later

Technical summary

The Site Reports component in Firefox and Thunderbird has a denial-of-service vulnerability. This issue was fixed in Firefox 158 and Thunderbird 158. The vulnerability could potentially allow attackers to cause a denial-of-service condition. Defenders should verify if their systems use affected Firefox or Thunderbird versions and update to version 158 or later. This requires immediate attention to prevent potential denial-of-service attacks. The CVE record and source item provide details on the denial-of-service vulnerability in the Site Reports component of Firefox and Thunderbird.

Defensive priority

Defenders should verify if their systems use affected Firefox or Thunderbird versions and update to version 158 or later. This requires immediate attention to prevent potential denial-of-service attacks.

Recommended defensive actions

• Verify if systems use affected Firefox or Thunderbird versions
• Update to version 158 or later
• Monitor for potential denial-of-service attacks
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and source item provide details on the denial-of-service vulnerability in the Site Reports component of Firefox and Thunderbird. The vulnerability was fixed in Firefox 158 and Thunderbird 158.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.