CVE-2026-109724 - Vulnerability Details - OpenCVE

Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Mozilla	Firefox

No data.

No data.

References

Link	Providers
https://bugzilla.mozilla.org/show_bug.cgi?id=2074193
https://www.mozilla.org/security/advisories/mfsa2026-106/
https://www.mozilla.org/security/advisories/mfsa2026-108/
https://www.mozilla.org/security/advisories/mfsa2026-109/
https://www.mozilla.org/security/advisories/mfsa2026-110/

History

Tue, 13 Oct 2026 18:30:00 +0000

Type	Values Removed	Values Added
Description	Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 158 and Firefox ESR 153.5.	Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.
References		https://www.mozilla.org/security/advisories/mfsa2026-109/ https://www.mozilla.org/security/advisories/mfsa2026-110/

Tue, 13 Oct 2026 16:45:00 +0000

Type	Values Removed	Values Added
First Time appeared		Mozilla Mozilla firefox
Vendors & Products		Mozilla Mozilla firefox

Tue, 13 Oct 2026 15:30:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-416
Metrics		cvssV3_1 `{'score': 5.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N'}`

Tue, 13 Oct 2026 13:00:00 +0000

Type	Values Removed	Values Added
Description		Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 158 and Firefox ESR 153.5.
Title		Use-after-free in the DOM: Core & HTML component
References		https://bugzilla.mozilla.org/show_bug.cgi?id=2074193 https://www.mozilla.org/security/advisories/mfsa2026-106/ https://www.mozilla.org/security/advisories/mfsa2026-108/

MITRE

Status: PUBLISHED

Assigner: mozilla

Published: 2026-10-13T12:29:24.312Z

Updated: 2026-10-13T18:16:57.204Z

Reserved: 2026-10-13T00:29:31.304Z

Link: CVE-2026-109724

Vulnrichment

No data.

NVD

Status : Deferred

Published: 2026-10-13T13:17:22.907

Modified: 2026-10-13T19:18:36.123

Link: CVE-2026-109724

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-109724", "assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe", "state": "PUBLISHED", "assignerShortName": "mozilla", "dateReserved": "2026-10-13T00:29:31.304Z", "datePublished": "2026-10-13T12:29:24.312Z", "dateUpdated": "2026-10-13T18:16:57.204Z"}, "containers": {"cna": {"affected": [{"product": "Firefox", "vendor": "Mozilla", "versions": [{"status": "unaffected", "version": "153.5", "lessThanOrEqual": "153.*", "versionType": "rpm"}, {"status": "unaffected", "version": "158", "lessThanOrEqual": "*", "versionType": "rpm"}]}, {"product": "Thunderbird", "vendor": "Mozilla", "versions": [{"status": "unaffected", "version": "153.5", "lessThanOrEqual": "153.*", "versionType": "rpm"}, {"status": "unaffected", "version": "158", "lessThanOrEqual": "*", "versionType": "rpm"}]}], "descriptions": [{"lang": "en", "value": "Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5."}]}], "title": "Use-after-free in the DOM: Core & HTML component", "references": [{"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2074193"}, {"url": "https://www.mozilla.org/security/advisories/mfsa2026-106/"}, {"url": "https://www.mozilla.org/security/advisories/mfsa2026-108/"}, {"url": "https://www.mozilla.org/security/advisories/mfsa2026-109/"}, {"url": "https://www.mozilla.org/security/advisories/mfsa2026-110/"}], "credits": [{"lang": "en", "value": "Mozilla"}], "providerMetadata": {"orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe", "shortName": "mozilla", "dateUpdated": "2026-10-13T18:16:57.204Z"}}, "adp": [{"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-109724", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-13T14:13:16.258639Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-416", "description": "CWE-416 Use After Free"}]}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-13T14:18:49.971Z"}}]}}

{"affected": [{"affectedData": [{"product": "Firefox", "vendor": "Mozilla", "versions": [{"lessThanOrEqual": "153.*", "status": "unaffected", "version": "153.5", "versionType": "rpm"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "158", "versionType": "rpm"}]}, {"product": "Thunderbird", "vendor": "Mozilla", "versions": [{"lessThanOrEqual": "153.*", "status": "unaffected", "version": "153.5", "versionType": "rpm"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "158", "versionType": "rpm"}]}], "source": "security@mozilla.org"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5."}], "id": "CVE-2026-109724", "lastModified": "2026-10-13T19:18:36.123", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.5, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-109724", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-10-13T14:13:16.258639Z", "version": "2.0.3"}}]}, "published": "2026-10-13T13:17:22.907", "references": [{"source": "security@mozilla.org", "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2074193"}, {"source": "security@mozilla.org", "url": "https://www.mozilla.org/security/advisories/mfsa2026-106/"}, {"source": "security@mozilla.org", "url": "https://www.mozilla.org/security/advisories/mfsa2026-108/"}, {"source": "security@mozilla.org", "url": "https://www.mozilla.org/security/advisories/mfsa2026-109/"}, {"source": "security@mozilla.org", "url": "https://www.mozilla.org/security/advisories/mfsa2026-110/"}], "sourceIdentifier": "security@mozilla.org", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-416"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}