CVE-2026-109750: Firefox DOM Authentication Bypass Flaw

CVE-2026-109750 Overview

CVE-2026-109750 is a site isolation issue in the DOM: Web Authentication component of Mozilla Firefox and Thunderbird. The flaw affects how the browser enforces process-level separation between origins when handling Web Authentication (WebAuthn) operations. Mozilla fixed the issue in Firefox 158 and Thunderbird 158. The vulnerability is documented in Mozilla Security Advisories MFSA-2026-106 and MFSA-2026-109, with technical analysis in Mozilla Bug Report #2067571.

Critical Impact

A site isolation weakness in the WebAuthn code path can weaken cross-origin boundaries that normally protect authentication ceremonies from untrusted content.

Affected Products

• Mozilla Firefox versions prior to 158
• Mozilla Thunderbird versions prior to 158
• Deployments relying on WebAuthn credentials served through affected Firefox or Thunderbird builds

Discovery Timeline

• 2026-10-13 - CVE-2026-109750 published to the National Vulnerability Database
• 2026-10-13 - Last updated in NVD database

Technical Details for CVE-2026-109750

Vulnerability Analysis

The vulnerability resides in the DOM: Web Authentication component, which implements the WebAuthn API inside Gecko. Site isolation is designed to run documents from different origins in separate processes so that one origin cannot observe or influence another. A failure in that boundary within the WebAuthn code path means authentication-related state or operations may not be fully segregated by origin.

WebAuthn ceremonies handle sensitive security material, including public key credential assertions and attestation data. Weakening the isolation guarantees around these operations undermines the trust model that depends on strict origin separation. Mozilla classifies the defect as a site isolation issue rather than a direct memory corruption bug.

The EPSS model currently places exploitation likelihood in the low range, consistent with the complexity of reaching the affected code path from an attacker-controlled context. Mozilla has not published evidence of exploitation in the wild.

Root Cause

The root cause is incomplete enforcement of site isolation within the WebAuthn implementation. The browser process model is intended to prevent cross-origin interference, but the WebAuthn code path did not uphold that invariant in all cases. Mozilla's advisories reference the fix landing in Firefox 158 and Thunderbird 158 without disclosing low-level exploitation details.

Attack Vector

An attacker would need to deliver content to a vulnerable Firefox or Thunderbird instance that interacts with the WebAuthn component in a way that crosses the intended origin boundary. Because Thunderbird renders HTML content for messages, email-borne content paths are relevant in addition to standard browsing. No public proof-of-concept exploit is listed in the available references.

The vulnerability manifests in the WebAuthn site isolation enforcement path. See the Mozilla advisories and Bug Report #2067571 for technical details.

Detection Methods for CVE-2026-109750

Indicators of Compromise

• No vendor-published indicators of compromise are associated with CVE-2026-109750 at this time.
• Mozilla has not released file hashes, network signatures, or exploit artifacts for this issue.

Detection Strategies

• Inventory Firefox and Thunderbird installations and flag any build earlier than version 158 for remediation.
• Correlate browser version telemetry from endpoint management with Mozilla advisory data to surface non-compliant hosts.
• Monitor for unexpected WebAuthn ceremonies originating from unusual sites or sessions where strong authentication is not expected.

Monitoring Recommendations

• Collect browser process metadata and extension inventories through endpoint agents and ship them to a centralized data lake.
• Alert on authentication platform events that show WebAuthn assertions from unfamiliar user agents or outdated Firefox builds.
• Review Thunderbird client versions used to access corporate mail, since the same component is affected there.

How to Mitigate CVE-2026-109750

Immediate Actions Required

• Upgrade Firefox to version 158 or later on all managed endpoints.
• Upgrade Thunderbird to version 158 or later for all users who process email with the client.
• Restart browser and mail client processes after update to ensure the patched binaries are loaded.
• Confirm patch compliance through endpoint management reporting before closing remediation tickets.

Patch Information

Mozilla addressed the issue in Firefox 158 and Thunderbird 158. Refer to MFSA-2026-106 and MFSA-2026-109 for the official fix notes and version matrices.

Workarounds

• No vendor-approved workarounds are published; applying the vendor patch is the supported remediation.
• Restrict use of Firefox and Thunderbird for high-value WebAuthn-protected applications until endpoints are updated.
• Enforce automatic updates for Mozilla products through enterprise configuration policies to shorten exposure windows.

# Verify installed Firefox version on Linux endpoints
firefox --version

# Verify installed Thunderbird version on Linux endpoints
thunderbird --version

# Example enterprise policy snippet to enforce automatic updates
# /etc/firefox/policies/policies.json
{
  "policies": {
    "DisableAppUpdate": false,
    "AppAutoUpdate": true
  }
}