CVE-2026-109750 - Vulnerability Details - OpenCVE

Site isolation issue in the DOM: Web Authentication component. This vulnerability was fixed in Firefox 158 and Thunderbird 158.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Changed

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact total

Vendors	Products
Mozilla	Firefox

No data.

No data.

References

Link	Providers
https://bugzilla.mozilla.org/show_bug.cgi?id=2067571
https://www.mozilla.org/security/advisories/mfsa2026-106/
https://www.mozilla.org/security/advisories/mfsa2026-109/

History

Mon, 19 Oct 2026 21:30:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-862
Metrics		cvssV3_1 `{'score': 9.6, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H'}` ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Sat, 17 Oct 2026 07:00:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-200

Tue, 13 Oct 2026 18:30:00 +0000

Type	Values Removed	Values Added
Description	Site isolation issue in the DOM: Web Authentication component. This vulnerability was fixed in Firefox 158.	Site isolation issue in the DOM: Web Authentication component. This vulnerability was fixed in Firefox 158 and Thunderbird 158.
References		https://www.mozilla.org/security/advisories/mfsa2026-109/

Tue, 13 Oct 2026 16:45:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-200

Tue, 13 Oct 2026 16:30:00 +0000

Type	Values Removed	Values Added
First Time appeared		Mozilla Mozilla firefox
Vendors & Products		Mozilla Mozilla firefox

Tue, 13 Oct 2026 13:00:00 +0000

Type	Values Removed	Values Added
Description		Site isolation issue in the DOM: Web Authentication component. This vulnerability was fixed in Firefox 158.
Title		Site isolation issue in the DOM: Web Authentication component
References		https://bugzilla.mozilla.org/show_bug.cgi?id=2067571 https://www.mozilla.org/security/advisories/mfsa2026-106/

MITRE

Status: PUBLISHED

Assigner: mozilla

Published: 2026-10-13T12:29:28.831Z

Updated: 2026-10-19T20:37:24.455Z

Reserved: 2026-10-13T00:29:55.352Z

Link: CVE-2026-109750

Vulnrichment

Updated: 2026-10-19T20:37:11.267Z

NVD

Status : Deferred

Published: 2026-10-13T13:17:25.887

Modified: 2026-10-19T21:17:04.920

Link: CVE-2026-109750

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-109750", "assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe", "state": "PUBLISHED", "assignerShortName": "mozilla", "dateReserved": "2026-10-13T00:29:55.352Z", "datePublished": "2026-10-13T12:29:28.831Z", "dateUpdated": "2026-10-19T20:37:24.455Z"}, "containers": {"cna": {"affected": [{"product": "Firefox", "vendor": "Mozilla", "versions": [{"status": "unaffected", "version": "158", "lessThanOrEqual": "*", "versionType": "rpm"}]}, {"product": "Thunderbird", "vendor": "Mozilla", "versions": [{"status": "unaffected", "version": "158", "lessThanOrEqual": "*", "versionType": "rpm"}]}], "descriptions": [{"lang": "en", "value": "Site isolation issue in the DOM: Web Authentication component. This vulnerability was fixed in Firefox 158 and Thunderbird 158.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "Site isolation issue in the DOM: Web Authentication component. This vulnerability was fixed in Firefox 158 and Thunderbird 158."}]}], "title": "Site isolation issue in the DOM: Web Authentication component", "references": [{"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2067571"}, {"url": "https://www.mozilla.org/security/advisories/mfsa2026-106/"}, {"url": "https://www.mozilla.org/security/advisories/mfsa2026-109/"}], "credits": [{"lang": "en", "value": "cl0und"}], "providerMetadata": {"orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe", "shortName": "mozilla", "dateUpdated": "2026-10-13T18:08:20.730Z"}}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-862", "lang": "en", "description": "CWE-862 Missing Authorization"}]}], "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 9.6, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-10-19T20:37:17.777350Z", "id": "CVE-2026-109750", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-19T20:37:24.455Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 9.6, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-109750", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-19T20:37:17.777350Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-862", "description": "CWE-862 Missing Authorization"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-19T20:37:11.267Z"}}], "cna": {"title": "Site isolation issue in the DOM: Web Authentication component", "credits": [{"lang": "en", "value": "cl0und"}], "affected": [{"vendor": "Mozilla", "product": "Firefox", "versions": [{"status": "unaffected", "version": "158", "versionType": "rpm", "lessThanOrEqual": "*"}]}, {"vendor": "Mozilla", "product": "Thunderbird", "versions": [{"status": "unaffected", "version": "158", "versionType": "rpm", "lessThanOrEqual": "*"}]}], "references": [{"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2067571"}, {"url": "https://www.mozilla.org/security/advisories/mfsa2026-106/"}, {"url": "https://www.mozilla.org/security/advisories/mfsa2026-109/"}], "descriptions": [{"lang": "en", "value": "Site isolation issue in the DOM: Web Authentication component. This vulnerability was fixed in Firefox 158 and Thunderbird 158.", "supportingMedia": [{"type": "text/html", "value": "Site isolation issue in the DOM: Web Authentication component. This vulnerability was fixed in Firefox 158 and Thunderbird 158.", "base64": false}]}], "providerMetadata": {"orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe", "shortName": "mozilla", "dateUpdated": "2026-10-13T18:08:20.730Z"}}}, "cveMetadata": {"cveId": "CVE-2026-109750", "state": "PUBLISHED", "dateUpdated": "2026-10-19T20:37:24.455Z", "dateReserved": "2026-10-13T00:29:55.352Z", "assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe", "datePublished": "2026-10-13T12:29:28.831Z", "assignerShortName": "mozilla"}, "dataVersion": "5.2"}