CVE-2026-109777: Firefox IndexedDB Information Disclosure

CVE-2026-109777 Overview

CVE-2026-109777 is an information disclosure vulnerability in the Storage: IndexedDB component used by Mozilla Firefox and Thunderbird. Mozilla fixed the flaw in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5. The weakness is categorized under CWE-200: Exposure of Sensitive Information to an Unauthorized Actor. Exploitation requires user interaction, such as visiting an attacker-controlled web page, and leaks limited confidentiality data without affecting integrity or availability.

Critical Impact
An attacker who convinces a user to load malicious web content can read information from the IndexedDB storage layer that should remain isolated to its originating site.

Affected Products

Mozilla Firefox versions prior to 158
Mozilla Firefox ESR versions prior to 153.5
Mozilla Thunderbird versions prior to 158 and 153.5

Discovery Timeline

2026-10-13 - CVE-2026-109777 published to the National Vulnerability Database
2026-10-13 - Last updated in NVD database

Technical Details for CVE-2026-109777

Vulnerability Analysis

The flaw resides in the Storage: IndexedDB subsystem, which Firefox and Thunderbird use to persist structured client-side data. IndexedDB enforces same-origin isolation so that one site cannot read entries written by another. CVE-2026-109777 breaks that boundary and allows an attacker to observe data that should remain confidential to its origin.

Mozilla classifies the issue as an information disclosure defect. The vulnerability does not permit modification of stored data, denial of service, or arbitrary code execution. The confidentiality impact is limited rather than total, consistent with partial leakage of records or metadata rather than full database exfiltration.

Additional technical specifics are tracked in Mozilla Bug Report #2069638 and the affiliated advisories MFSA-2026-106, MFSA-2026-108, MFSA-2026-109, and MFSA-2026-110.

Root Cause

The root cause is improper enforcement of isolation boundaries within the IndexedDB storage component. The affected code paths permit sensitive content to be read in a context that should not have been granted access.

Attack Vector

Exploitation requires an attacker to host malicious web content and lure a user of a vulnerable Firefox or Thunderbird build into rendering it. Once the content executes within the browser, the IndexedDB defect allows the attacker's script to retrieve information from storage it would not normally be able to access. No elevated privileges and no credentials are required.

No public proof-of-concept, exploit code, or evidence of in-the-wild exploitation has been published. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog, and the EPSS probability stands at 0.21%.

Detection Methods for CVE-2026-109777

Indicators of Compromise

No file-based or network-based indicators of compromise have been published for CVE-2026-109777.
Presence of outdated Firefox (<158), Firefox ESR (<153.5), or Thunderbird (<158 / <153.5) builds in the environment is the most reliable observable risk signal.

Detection Strategies

Inventory Firefox and Thunderbird installations across managed endpoints and compare installed versions against the fixed releases.
Correlate browser telemetry with navigation to untrusted origins that execute large volumes of IndexedDB operations against unexpected object stores.
Review browser crash and console telemetry for anomalous IndexedDB access failures that may indicate exploitation attempts.

Monitoring Recommendations

Enable centralized endpoint telemetry to track browser and mail-client versions and alert on noncompliant builds.
Monitor web proxy and DNS logs for connections to newly registered or low-reputation domains serving JavaScript-heavy payloads.
Track Mozilla security advisories so new Firefox and Thunderbird releases trigger patch validation workflows.

How to Mitigate CVE-2026-109777

Immediate Actions Required

Upgrade Firefox to version 158 or later on all managed endpoints.
Upgrade Firefox ESR to version 153.5 or later where the ESR channel is required.
Upgrade Thunderbird to version 158 or 153.5, matching the deployed release channel.
Validate that automatic update mechanisms are enabled and functional for both products.

Patch Information

Mozilla addressed CVE-2026-109777 in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5. Patch and advisory details are published in MFSA-2026-106, MFSA-2026-108, MFSA-2026-109, and MFSA-2026-110.

Workarounds

No vendor-supplied workaround exists; applying the fixed releases is the supported remediation.
Restrict high-risk users from browsing untrusted sites until patches are deployed.
Enforce enterprise policies that disable or restrict IndexedDB usage for untrusted origins where feasible, understanding this may break legitimate web applications.

bash

# Example: enforce minimum Firefox version via policies.json on Linux
# Deploy to /etc/firefox/policies/policies.json
{
  "policies": {
    "DisableAppUpdate": false,
    "AppAutoUpdate": true,
    "OverrideFirstRunPage": "",
    "BlockAboutConfig": false
  }
}