TI-2026-71888 Aliases CVE-2026-109777 GHSA-p7qg-vwq5-7rqr

Information disclosure in Mozilla Firefox and Thunderbird IndexedDB

LOW 19CWE-200Published 2026-10-13 · Updated 2026-10-13

Key facts

Attack vector: Network
Privileges required: None
User interaction: Required
Attack complexity: Low
Impact type: Information disclosure
Confidentiality · integrity · availability: Low · None · None
Fix status: Partial Red Hat: 3 fixed, 5 without a fix

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and Red Hat. Impact type from CWE-200.

Summary

Mozilla Firefox and Thunderbird contain an information disclosure flaw in the Storage: IndexedDB component, classified as CWE-200 (exposure of sensitive information to an unauthorized actor). A remote attacker without privileges can gain access to sensitive information, but a user must interact with the attack. The CVSS 3.1 base score is 4.3.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Description from the CNA

Information disclosure in the Storage: IndexedDB component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.0021 11th percentileScored 2026-11-07

Fix Partial Firefox (Mozilla): 153.5, 158Thunderbird (Mozilla): 153.5, 158Red Hat: 3 advisoriesRed Hat: 3 fixed, 5 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Mozilla	Firefox	—	153.5, 158	Patch available	CNA
Mozilla	Thunderbird	—	153.5, 158	Patch available	CNA

Firefox VendorMozilla Affected — Fixed in 153.5, 158 Patch available CNA
Thunderbird VendorMozilla Affected — Fixed in 153.5, 158 Patch available CNA

CPE names Threatist (inferred) · 2

Inferred from how NVD named this product before; not given by a source.

CPE	Versions	Role	Vendor
cpe:2.3:a:mozilla:firefox::::::::	—	—	Mozilla
cpe:2.3:a:mozilla:thunderbird::::::::	—	—	Mozilla

cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:* Versions — — ·Mozilla
cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:* Versions — — ·Mozilla

Remediation

Update Firefox to 153.5 or 158 and Thunderbird to 153.5 or 158. Red Hat fixes Thunderbird in RHSA-2026:93443 for Red Hat Enterprise Linux AppStream (v. 9), RHSA-2026:95597 for Red Hat Enterprise Linux AppStream E4S (v.9.4) and RHSA-2026:95596 for Red Hat Enterprise Linux AppStream EUS (v.9.6). Red Hat has no fix available for Red Hat Enterprise Linux 7, 8, 9 and 10, and no fix is planned for Red Hat Enterprise Linux 6.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Fix · CNA Firefox (Mozilla) Fixed in 153.5, 158
Fix · CNA Thunderbird (Mozilla) Fixed in 153.5, 158

Red Hat 3 advisories

RHSA-2026:95596 Released 2026-11-05 · Red Hat rating Important
thunderbird security, bug fix, and enhancement update
- Red Hat Enterprise Linux AppStream EUS (v.9.6) thunderbird-153.5.0-1.el9_6
RHSA-2026:95597 Released 2026-11-05 · Red Hat rating Important
thunderbird security, bug fix, and enhancement update
- Red Hat Enterprise Linux AppStream E4S (v.9.4) thunderbird-153.5.0-1.el9_4
RHSA-2026:93443 Released 2026-11-02 · Red Hat rating Important
thunderbird security, bug fix, and enhancement update
- Red Hat Enterprise Linux AppStream (v. 9) thunderbird-153.5.0-1.el9_8

Vendor assessments

Red Hat

Red Hat rating: Low. Red Hat's page for this CVE →

Product	Status	Plan or fix
Red Hat Enterprise Linux 10	Affected	No fix yet
Red Hat Enterprise Linux 6	Affected	No fix planned: Out of support scope
Red Hat Enterprise Linux 7	Affected	No fix yet
Red Hat Enterprise Linux 8	Affected	No fix yet
Red Hat Enterprise Linux 9	Affected	No fix yet
Red Hat Enterprise Linux AppStream (v. 9)	Fixed	RHSA-2026:93443
Red Hat Enterprise Linux AppStream E4S (v.9.4)	Fixed	RHSA-2026:95597
Red Hat Enterprise Linux AppStream EUS (v.9.6)	Fixed	RHSA-2026:95596

Timeline

2026-10-13 Threatist record created from CVE-2026-109777
2026-10-13 Alias added: GHSA-p7qg-vwq5-7rqr
2026-10-13 Fix available: Mozilla/[email protected], Mozilla/Thunderbird@158 · CNA
2026-10-13 2 new references · CNA
2026-10-31 Affected versions changed · Red Hat
2026-10-31 CVSS score added · Red Hat
2026-11-02 Fix available: RHSA-2026:93443 · Red Hat
2026-11-02 Fix available: Red Hat Enterprise Linux AppStream (v. 9) · Red Hat
2026-11-06 Fix available: RHSA-2026:95597 · Red Hat
2026-11-06 Fix available: RHSA-2026:95596 · Red Hat
2026-11-06 Fix available: Red Hat Enterprise Linux AppStream E4S (v.9.4), Red Hat Enterprise Linux AppStream EUS (v.9.6) · Red Hat

References

Other 5

TI-2024-08981 Use after free in Mozilla Firefox KEVCVSS 3.1CRITICAL 9.8
TI-2022-09832 Use after free in Mozilla Firefox KEVCVSS 3.1CRITICAL 9.6
TI-2019-08769 Improper input validation in Mozilla Firefox ESR KEVCVSS 3.1CRITICAL 10.0
TI-2010-03577 Mozilla Firefox 3.5.x through 3.5.14 and 3.6.x through 3.6.11, Thunderbird 3.1.6 before… KEVCVSS 3.1CRITICAL 9.8
TI-2023-04799 Out-of-bounds write in Google Chrome KEVCVSS 3.1HIGH 8.8
TI-2023-04477 Out-of-bounds write in Google Chrome KEVCVSS 3.1HIGH 8.8

See all 4204 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences