BugRater
Early access. The directory is still filling out, and every rating here comes from a researcher's reported experience.

Security releases

Mozilla

Security Vulnerabilities fixed in Firefox 158

MFSA2026-106 Oct 13, 2026 Source: Vendor

Imported from Mozilla security advisory MFSA2026-106. Draft.

Source of record The credited names below are quoted verbatim from the vendor's own advisory: https://www.mozilla.org/en-US/security/advisories/mfsa2026-106/
Are you credited here? Sign in to claim your line. It is yours immediately, with no review queue. The name the vendor printed stays next to your handle for anyone to check against the advisory above, and any member who thinks a claim is wrong can refute it.

Credited

77 lines
All 77 CVEs 77 Additional recognition 0 Unclaimed only
Showing 51–77 of 77 , page 2 of 2
CVE-2026-109754 BR2026-0000-033934 unclaimed
Moderate: Incorrect boundary conditions in the DOM: Editor component
Credited as Mozilla
CVE-2026-109755 BR2026-0000-033935 unclaimed
Moderate: Sandbox escape in the DOM: Content Processes component
Credited as Mozilla
CVE-2026-109756 BR2026-0000-033936 unclaimed
Moderate: Privilege escalation in the DOM: Navigation component
Credited as Mozilla
CVE-2026-109757 BR2026-0000-033937 unclaimed
Moderate: Sandbox escape due to race condition in the Networking component
Credited as Yaqoub Aldurayhim
CVE-2026-109759 BR2026-0000-033938 unclaimed
Moderate: Site isolation issue in the Networking component
Credited as Myungyong Lee
CVE-2026-109760 BR2026-0000-033939 unclaimed
Moderate: Mitigation bypass in the Networking: HTTP component
Credited as Myungyong Lee
CVE-2026-109761 BR2026-0000-033940 unclaimed
Moderate: Use-after-free in the JavaScript: WebAssembly component
Credited as Mozilla
CVE-2026-109762 BR2026-0000-033941 unclaimed
Moderate: Incorrect boundary conditions in the SVG component
Credited as Mozilla
CVE-2026-109763 BR2026-0000-033942 unclaimed
Moderate: Mitigation bypass in the File Handling component
Credited as Riku Bamba
CVE-2026-109764 BR2026-0000-033943 unclaimed
Moderate: Mitigation bypass in the Enterprise Policies component
Credited as HyeonSeung Kim
CVE-2026-109765 BR2026-0000-033944 unclaimed
Moderate: Race condition, use-after-free in the Graphics: Text component
Credited as Shu Takahashi of Velcore Consulting Inc.
CVE-2026-109766 BR2026-0000-033945 unclaimed
Moderate: Mitigation bypass in the Enterprise Policies component
Credited as Souma Ohsawa
CVE-2026-109767 BR2026-0000-033946 unclaimed
Moderate: Information disclosure in the Networking component
Credited as Mozilla
CVE-2026-109768 BR2026-0000-033947 unclaimed
Low: Denial-of-service in the Site Reports component
Credited as Mozilla
CVE-2026-109769 BR2026-0000-033948 unclaimed
Low: Information disclosure in the Networking: Cache component
Credited as Mohamed Mbarek
CVE-2026-109770 BR2026-0000-033949 unclaimed
Low: Spoofing issue in the DOM: Web Serial component
Credited as Mozilla
CVE-2026-109771 BR2026-0000-033950 unclaimed
Low: Information disclosure in the WebRTC: Networking component
Credited as 5up3rh3i
CVE-2026-109772 BR2026-0000-033951 unclaimed
Low: Same-origin policy bypass in the DevTools component
Credited as Finn Westendorf
CVE-2026-109773 BR2026-0000-033952 unclaimed
Low: Denial-of-service in the Sync component
Credited as Bruno
CVE-2026-109774 BR2026-0000-033953 unclaimed
Low: Invalid pointer, undefined behavior in the DOM: Notifications component
Credited as zx
CVE-2026-109775 BR2026-0000-033954 unclaimed
Low: Denial-of-service in the WebRTC component
Credited as Shu Takahashi of Velcore Consulting Inc.
CVE-2026-109776 BR2026-0000-033955 unclaimed
Low: Race condition in the XPCOM component
Credited as Mozilla
CVE-2026-109777 BR2026-0000-033956 unclaimed
Low: Information disclosure in the Storage: IndexedDB component
Credited as Shu Takahashi of Velcore Consulting Inc.
CVE-2026-109778 BR2026-0000-033957 unclaimed
Low: Privilege escalation in the WebExtensions component
Credited as Mozilla
CVE-2026-109779 BR2026-0000-033958 unclaimed
Low: Race condition in the Networking: DNS component
Credited as Mozilla
CVE-2026-109780 BR2026-0000-033959 unclaimed
Low: Mitigation bypass in the DOM: Core & HTML component
Credited as Shannon Booth
CVE-2026-109781 BR2026-0000-033960 unclaimed
Low: Denial-of-service in the Printing: Output component
Credited as Nguyen Thanh Nguyen