CVE-2026-109771: Firefox WebRTC Information Disclosure Bug

CVE-2026-109771 Overview

CVE-2026-109771 is an information disclosure vulnerability in the WebRTC: Networking component of Mozilla Firefox and Thunderbird. The flaw allows a remote attacker to access limited confidential data when a user interacts with crafted web content. Mozilla addressed the issue in Firefox 158 and Thunderbird 158. The weakness is categorized as [CWE-200] (Exposure of Sensitive Information to an Unauthorized Actor).

Critical Impact
Remote attackers can obtain unauthorized access to sensitive information processed by the WebRTC networking stack when a user visits malicious web content.

Affected Products

Mozilla Firefox versions prior to 158
Mozilla Thunderbird versions prior to 158
WebRTC: Networking component shipped by both products

Discovery Timeline

2026-10-13 - CVE-2026-109771 published to the National Vulnerability Database (NVD)
2026-10-13 - Last updated in the NVD database

Technical Details for CVE-2026-109771

Vulnerability Analysis

The vulnerability resides in the WebRTC networking subsystem used by Firefox and Thunderbird for real-time audio, video, and data channel communications. According to the Mozilla advisories MFSA-2026-106 and MFSA-2026-109, the component improperly exposes information to callers that should not have access to it. Exploitation requires user interaction, typically visiting a web page that establishes a WebRTC session. The disclosed data is limited in scope but can aid an attacker during reconnaissance of a target browser or messaging client.

Root Cause

The root cause maps to [CWE-200], where the WebRTC networking code returns or renders data that crosses a trust boundary. Mozilla has not published low-level implementation details beyond the fix references in Bugzilla #2059658. The condition is reachable from untrusted web content loaded by the browser or by HTML-rendered email in Thunderbird.

Attack Vector

The attack vector is network-based with low complexity and no privileges required. An attacker hosts crafted web content that initiates a WebRTC exchange when the victim loads the page. User interaction, such as navigating to the attacker-controlled site or opening a prepared message, is necessary to trigger the condition. No synthetic exploitation code is produced here because no verified public proof of concept is available. Refer to the Mozilla Bug Report #2059658 for upstream technical context.

Detection Methods for CVE-2026-109771

Indicators of Compromise

Firefox or Thunderbird clients running versions earlier than 158 initiating outbound WebRTC sessions to unexpected STUN, TURN, or signaling endpoints.
Browser telemetry showing WebRTC RTCPeerConnection creation from previously unvisited or low-reputation domains.
Unusual DNS queries for signaling servers associated with suspicious infrastructure.

Detection Strategies

Inventory installed browser and mail client versions and flag any instance below Firefox 158 or Thunderbird 158.
Correlate web proxy logs with endpoint process telemetry to identify WebRTC handshakes initiated from vulnerable builds.
Alert on JavaScript on untrusted domains invoking WebRTC APIs against users of outdated clients.

Monitoring Recommendations

Monitor software inventory feeds for drift from the approved Firefox and Thunderbird baseline.
Track STUN/TURN protocol traffic from endpoints that normally do not use real-time communications.
Log and review Thunderbird remote content loading events, since HTML email can reach the WebRTC subsystem.

How to Mitigate CVE-2026-109771

Immediate Actions Required

Upgrade Firefox to version 158 or later across all managed endpoints.
Upgrade Thunderbird to version 158 or later for all users with mail clients deployed.
Validate patch coverage through endpoint management tooling and remediate systems that fail to update.

Patch Information

Mozilla released fixes in Firefox 158 and Thunderbird 158. Refer to the Mozilla Security Advisory MFSA-2026-106 and Mozilla Security Advisory MFSA-2026-109 for the authoritative patch metadata and bug references.

Workarounds

Disable WebRTC in Firefox by setting media.peerconnection.enabled to false in about:config where real-time communications are not required.
Block remote content rendering in Thunderbird to prevent HTML messages from reaching the WebRTC component.
Restrict access to untrusted web content for users who cannot upgrade immediately through browser isolation or proxy filtering.

bash

# Configuration example: disable WebRTC in Firefox via a policies.json file
# Place this file in the Firefox distribution directory
{
  "policies": {
    "Preferences": {
      "media.peerconnection.enabled": {
        "Value": false,
        "Status": "locked"
      }
    }
  }
}