CVE-2026-109755

CVSS: 9.6v3.1CriticalDeferred

Published 2026-10-13Last modified 2026-10-15

Open JSON

Vulnerability summary

Overall risk

70/100

0100

High · default modelHow is this calculated?

CVSS score

9.6/10

010

Critical · v3.1 (CVE.org)

EPSS score

0.19%

0%100%

Low · Change unavailable

KEVNot listed0 of 3 catalogs

RansomwareNone recordedNo known use recorded

Public exploits0No public exploits recorded

Timeline

2026-10-13
PublishedVulnerability first disclosed.
2026-10-15
Last modifiedVulnerability information updated.

Description

Sandbox escape in the DOM: Content Processes component. This vulnerability was fixed in Firefox 158 and Thunderbird 158.

CVSS metrics

2 scores · 2 sources · 1 version

v3.19.6

EPSS trend

Probability

0.19%

Chance of exploitation in the next 30 days

Percentile

Versus all other CVEs

30-day change

Change unavailable

2026-10-142026-10-15

EPSS score

0.19%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-693Protection Mechanism FailureThe product does not use or incorrectly uses a protection mechanism that provides sufficient defense against directed attacks against the product.

Affected systems

No affected systems are recorded for this record.

References

3 links