{"id":"CVE-2026-109772","aliases":[],"cve":{"records":[{"id":"CVE-2026-109772","source":"mozilla","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-10-13T00:48:55.791Z","published":"2026-10-13T12:29:33.912Z","modified":"2026-10-26T19:41:32.255Z"}],"publishers":[{"name":"mozilla","role":"CNA","organizationId":"f16b083a-5664-49f3-a51e-8d479e5ed7fe","modified":"2026-10-13T18:08:32.263Z"},{"name":"CISA-ADP","role":"ADP","organizationId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","modified":"2026-10-26T19:41:32.255Z"}],"references":[{"url":"https://bugzilla.mozilla.org/show_bug.cgi?id=2066063","tags":[],"source":"mozilla"},{"url":"https://www.mozilla.org/security/advisories/mfsa2026-106/","tags":[],"source":"mozilla"},{"url":"https://www.mozilla.org/security/advisories/mfsa2026-109/","tags":[],"source":"mozilla"}],"weaknesses":[{"id":"CWE-346","description":"CWE-346 Origin Validation Error","source":"CISA-ADP"}],"applicability":[],"prioritization":[{"source":"CISA-ADP","type":"SSVC","role":"CISA Coordinator","timestamp":"2026-10-26T19:18:35.099061Z","decisions":[{"name":"Exploitation","value":"none"},{"name":"Automatable","value":"yes"},{"name":"Technical Impact","value":"total"}]}]},"title":"Same-origin policy bypass in the DevTools component","titleSource":"mozilla","descriptionSource":"mozilla","description":"Same-origin policy bypass in the DevTools component. This vulnerability was fixed in Firefox 158 and Thunderbird 158.","score":9.1,"severity":"critical","published":"2026-10-13T12:29:33.912Z","modified":"2026-10-26T19:41:32.255Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"Mozilla","name":"Firefox","platforms":[],"versions":[{"version":"158","status":"unaffected","lessThanOrEqual":"*","versionType":"rpm"}],"cpes":[],"source":"mozilla","url":"https://www.cve.org/CVERecord?id=CVE-2026-109772"},{"vendor":"Mozilla","name":"Thunderbird","platforms":[],"versions":[{"version":"158","status":"unaffected","lessThanOrEqual":"*","versionType":"rpm"}],"cpes":[],"source":"mozilla","url":"https://www.cve.org/CVERecord?id=CVE-2026-109772"}],"remediation":[],"references":["https://bugzilla.mozilla.org/show_bug.cgi?id=2066063","https://www.mozilla.org/security/advisories/mfsa2026-106/","https://www.mozilla.org/security/advisories/mfsa2026-109/"],"sources":[{"name":"CVE","id":"CVE-2026-109772","modified":"2026-10-26T19:41:32.255Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-109772"}],"assessments":[{"source":"CISA-ADP","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","score":9.1}],"sourceAffected":[],"observedAt":"2026-10-29T14:27:19.082Z","kev":{"status":"not-listed","checkedAt":"2026-10-31T00:45:31.953Z"},"coverage":[{"source":"NVD","status":"not-checked"},{"source":"GHSA","status":"not-checked"},{"source":"EUVD","status":"not-checked"},{"source":"EPSS","status":"not-checked"}],"evidence":[],"aiSummary":{"text":"A same-origin policy bypass vulnerability in the DevTools component of Firefox and Thunderbird was fixed in version 158. The weakness is an origin validation error. Local access may be required to exploit this vulnerability.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-10-30T08:41:02.074Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-109772"}]}}