Description
Mitigation bypass in the DOM: Security component. This vulnerability was fixed in Firefox 158 and Firefox ESR 153.5.
Published: 2026-10-13
Score: n/a
EPSS: n/a
KEV: No
Impact: Potential DOM security bypass enabling unintended script execution
Action: Patch Immediately
AI Analysis

Impact

The reported flaw allows an attacker to bypass the DOM security component in Mozilla Firefox. By subverting the intended security controls, malicious input can manipulate the document object model and execute scripts or modify page content that would otherwise be blocked. This can lead to unauthorized data disclosure or further exploitation of the vulnerable system.

Affected Systems

The issue affects all Firefox installations older than version 158 and all ESR builds older than 153.5. Users running these releases are potentially exposed unless they have applied the mitigations included in the subsequent versions.

Risk and Exploitability

The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, indicating no publicly known exploit yet. However, the nature of the DOM bypass suggests a high potential severity and significant exploitation risk once accessed. Immediate action is recommended to reduce exposure.

Generated by OpenCVE AI on October 13, 2026 at 16:26 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade Mozilla Firefox to version 158 or newer, or to Firefox ESR 153.5 or newer if using an extended support release.
  • Audit all systems for old Firefox installations and remove or block them from use.
  • Implement stricter content security policies or sandboxing for web content to reduce the attack surface in case an upgrade cannot be performed immediately.

Generated by OpenCVE AI on October 13, 2026 at 16:26 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 13 Oct 2026 16:45:00 +0000

Type Values Removed Values Added
First Time appeared Mozilla
Mozilla firefox
Weaknesses CWE-739
Vendors & Products Mozilla
Mozilla firefox

Tue, 13 Oct 2026 13:00:00 +0000

Type Values Removed Values Added
Description Mitigation bypass in the DOM: Security component. This vulnerability was fixed in Firefox 158 and Firefox ESR 153.5.
Title Mitigation bypass in the DOM: Security component
References

cve-icon MITRE

Status: PUBLISHED

Assigner: mozilla

Published:

Updated: 2026-10-13T12:29:24.715Z

Reserved: 2026-10-13T00:29:40.196Z

Link: CVE-2026-109734

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Deferred

Published: 2026-10-13T13:17:23.947

Modified: 2026-10-13T16:18:13.247

Link: CVE-2026-109734

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-13T16:30:10Z

Weaknesses