CVE-2026-109771 Mozilla CVE debrief

Who should care

Defenders responsible for Firefox deployments should assess exposure and apply the fix to prevent potential information disclosure. This includes verifying if Firefox version is less than 158 and updating to version 158 or later. The vulnerability may allow sensitive information to be disclosed, and defenders should prioritize verifying exposure and applying the fix. Defenders should also review compensating controls

Why it matters

Defenders should care about CVE-2026-109771 as it is an information disclosure vulnerability in Firefox's WebRTC: Networking component, which may allow sensitive information to be disclosed. The vulnerability was fixed in Firefox 158, and defenders responsible for Firefox deployments should assess exposure and apply the fix to prevent potential information disclosure. The CVE record and source item provide limited information about the vulnerability, but confirm it was fixed in Firefox 158.

• Potential information disclosure
• Verification of exposure required
• Fix application priority medium

Technical summary

The vulnerability is an information disclosure issue in the WebRTC: Networking component of Firefox, which was fixed in Firefox 158. This issue allows sensitive information to be disclosed, potentially impacting defenders who need to assess exposure and apply the fix promptly. The technical details confirm the vulnerability was fixed in Firefox 158, emphasizing the need for defenders to verify exposure and apply the fix to prevent potential information disclosure.

Defensive priority

Defenders should prioritize verifying exposure and applying the fix, as the vulnerability may allow information disclosure.

Recommended defensive actions

• Verify exposure by checking if Firefox version is less than 158
• Apply the fix by updating Firefox to version 158 or later
• Monitor for potential information disclosure

Evidence notes

The CVE record and source item provide limited information about the vulnerability, but confirm it was fixed in Firefox 158. Defenders should verify exposure by checking if Firefox version is less than 158 and apply the fix by updating Firefox to version 158 or later. The vulnerability may allow information disclosure, and defenders should prioritize verifying exposure and applying the fix. Evidence is limited to CVE metadata and source item details, which do not provide additional or

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.