CVE-2026-109775: Mozilla WebRTC DOS Vulnerability

CVE-2026-109775 Overview

CVE-2026-109775 is a denial-of-service vulnerability in the WebRTC (Web Real-Time Communication) component used by Mozilla Firefox and Thunderbird. The flaw is categorized under [CWE-400] Uncontrolled Resource Consumption. An attacker can trigger the condition remotely over the network when a user visits or interacts with a crafted page or communication session. Successful exploitation causes high availability impact without affecting confidentiality or integrity. Mozilla addressed the issue in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.

Critical Impact
Remote attackers can crash or render unresponsive Firefox and Thunderbird clients through the WebRTC component, disrupting real-time communications and browser availability.

Affected Products

Mozilla Firefox versions prior to 158
Mozilla Firefox ESR versions prior to 153.5
Mozilla Thunderbird versions prior to 158 and prior to 153.5

Discovery Timeline

2026-10-13 - CVE-2026-109775 published to NVD
2026-10-13 - Last updated in NVD database

Technical Details for CVE-2026-109775

Vulnerability Analysis

The vulnerability resides in the WebRTC component shared by Firefox and Thunderbird. WebRTC handles peer-to-peer audio, video, and data channel sessions directly in the browser. The flaw allows a remote attacker to exhaust client-side resources, producing a denial-of-service condition in the affected process. The attack requires user interaction, such as loading a malicious page or accepting a crafted real-time session. Only availability is impacted; the issue does not expose data or permit code execution.

Root Cause

The root cause is classified as uncontrolled resource consumption [CWE-400] within WebRTC processing paths. Specific technical details were not disclosed in the public advisory beyond the categorization and the fixed version numbers. See the referenced Mozilla advisories for product-level details.

Attack Vector

Exploitation occurs over the network and requires user interaction. A victim must open an attacker-controlled resource or participate in a WebRTC-enabled interaction that triggers the vulnerable code path. No privileges or authentication are required on the target. The scope remains unchanged, and the impact is limited to availability of the affected client process.

No public proof-of-concept code is available. Readers should consult Mozilla Security Advisory MFSA-2026-106, MFSA-2026-108, MFSA-2026-109, MFSA-2026-110, and Mozilla Bug Report #2068255 for additional context.

Detection Methods for CVE-2026-109775

Indicators of Compromise

Repeated crashes or unresponsive states in firefox.exe, thunderbird.exe, or their Linux and macOS equivalents during active WebRTC sessions.
Unusual spikes in CPU or memory consumption by Firefox or Thunderbird child processes handling media or data channels.
Browser crash reports referencing WebRTC subcomponents submitted around the time of user interaction with untrusted sites.

Detection Strategies

Inventory endpoints to identify Firefox and Thunderbird builds older than the fixed versions (Firefox 158, Firefox ESR 153.5, Thunderbird 158, Thunderbird 153.5).
Correlate crash telemetry with navigation events or inbound call activity that uses WebRTC APIs.
Flag outbound connections from browser processes to signaling or TURN servers associated with unknown domains.

Monitoring Recommendations

Monitor process stability metrics for Firefox and Thunderbird on managed endpoints.
Collect and review Mozilla crash reports for stack traces that touch WebRTC code paths.
Alert on repeated process restarts tied to the same user session or URL category.

How to Mitigate CVE-2026-109775

Immediate Actions Required

Upgrade Firefox to version 158 or later and Firefox ESR to 153.5 or later across all managed endpoints.
Upgrade Thunderbird to version 158 or Thunderbird 153.5 or later on all installations.
Prioritize deployment on systems that regularly use WebRTC-based conferencing or messaging platforms.

Patch Information

Mozilla fixed the vulnerability in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5. Refer to Mozilla Security Advisory MFSA-2026-106, MFSA-2026-108, MFSA-2026-109, and MFSA-2026-110 for product-specific guidance.

Workarounds

Restrict access to untrusted sites that use WebRTC through enterprise browser policy or network filtering until patches are deployed.
Disable WebRTC in Firefox by setting media.peerconnection.enabled to false in about:config where real-time communication is not required.
Train users to decline unexpected WebRTC calls or media prompts originating from unknown sources.

bash

# Configuration example: enterprise policy to disable WebRTC peer connections in Firefox
# Place in policies.json under the distribution directory
{
  "policies": {
    "Preferences": {
      "media.peerconnection.enabled": {
        "Value": false,
        "Status": "locked"
      }
    }
  }
}