CVE-2026-109774: Firefox & Thunderbird Use-After-Free Flaw

CVE-2026-109774 Overview

CVE-2026-109774 is a memory safety vulnerability in the DOM Notifications component used by Mozilla Firefox and Thunderbird. The flaw involves an invalid pointer that triggers undefined behavior during Notifications processing. Mozilla addressed the issue in Firefox 158 and Thunderbird 158, as documented in advisories MFSA-2026-106 and MFSA-2026-109. The National Vulnerability Database (NVD) has not yet assigned a CVSS score or CWE classification for this issue.

Critical Impact
Processing crafted web content that interacts with the Notifications API can trigger undefined behavior, potentially leading to crashes or memory corruption in the browser process.

Affected Products

Mozilla Firefox versions prior to 158
Mozilla Thunderbird versions prior to 158
Any downstream distribution bundling the affected Gecko DOM Notifications code

Discovery Timeline

2026-10-13 - CVE-2026-109774 published to NVD
2026-10-13 - Last updated in NVD database

Technical Details for CVE-2026-109774

Vulnerability Analysis

The vulnerability resides in the DOM Notifications component of Mozilla's Gecko engine. According to Mozilla's advisories, the component dereferences an invalid pointer during normal Notifications processing. Invalid pointer dereferences produce undefined behavior in C++ code, with outcomes ranging from benign crashes to exploitable memory corruption depending on allocator state and surrounding code paths. Mozilla classifies this issue within its standard memory-safety bug category and shipped the fix in the Firefox 158 and Thunderbird 158 release cycle. Detailed root-cause information is tracked in Mozilla Bug Report #2067657, which may remain access-restricted while downstream vendors ship updates.

Root Cause

The root cause is the use of an invalid pointer within the Notifications handling path in the DOM. The browser engine references memory that is no longer valid, or has not been properly initialized, when processing notification-related operations originating from web content. The exact trigger pattern has not been publicly disclosed in the NVD entry.

Attack Vector

Exploitation requires a user to load attacker-controlled or compromised web content that invokes the Notifications API in a way that reaches the vulnerable code path. Thunderbird is affected when it renders HTML content that reuses the same DOM engine. The attack vector requires no privileges beyond standard web content execution, though user interaction such as visiting a page is required.

No verified public proof-of-concept is available. Technical specifics are referenced in Mozilla Bug Report #2067657.

Detection Methods for CVE-2026-109774

Indicators of Compromise

Unexpected Firefox or Thunderbird process crashes with signatures referencing DOM Notifications or nsNotification symbols
Browser telemetry crash reports clustering around the Notifications component following visits to specific pages
Child process termination events on endpoints running Firefox or Thunderbird builds prior to version 158

Detection Strategies

Inventory installed Firefox and Thunderbird versions across the fleet and flag any build earlier than 158
Correlate Windows Error Reporting (WER), macOS CrashReporter, or Linux core dumps with the affected process names
Monitor outbound HTTP(S) traffic from browsers to newly registered or low-reputation domains that may host exploit content

Monitoring Recommendations

Ingest browser crash telemetry into the SIEM and alert on repeated faults in firefox.exe or thunderbird.exe
Track software inventory changes to confirm patch adoption of Firefox 158 and Thunderbird 158
Review web proxy logs for requests to pages invoking the Notifications API from untrusted origins

How to Mitigate CVE-2026-109774

Immediate Actions Required

Upgrade Mozilla Firefox to version 158 or later on all managed endpoints
Upgrade Mozilla Thunderbird to version 158 or later, including enterprise ESR channels where applicable
Validate patch deployment through software inventory and vulnerability management tooling
Restart affected browsers and mail clients after update to activate the fixed binaries

Patch Information

Mozilla released fixes in Firefox 158 and Thunderbird 158. Refer to Mozilla Security Advisory MFSA-2026-106 and Mozilla Security Advisory MFSA-2026-109 for the authoritative patch metadata, affected version ranges, and bundled security fixes.

Workarounds

Disable web notifications in about:config by setting dom.webnotifications.enabled to false until the patch is deployed
Restrict Notifications permission grants via enterprise policy using the Firefox Permissions policy with a default of block
Deploy content filtering to block access to untrusted web applications on unpatched endpoints

bash

# Firefox enterprise policy snippet to block notification permissions
# File: policies.json
{
  "policies": {
    "Permissions": {
      "Notifications": {
        "BlockNewRequests": true,
        "Locked": true
      }
    }
  }
}