Skip to content
OpenAdvisories
Critical · 9.6 CVE-2026-109750 EUVD-2026-98512GHSA-w5qr-crf7-85gx

Site isolation issue in the DOM: Web Authentication component

Published Oct 13, 2026 · Updated Oct 19, 2026 · Assigned by mozilla

Vendor: Mozilla Product: Firefox Product: Thunderbird Package: mozjs102 Package: mozjs115 Package: mozjs38 Package: mozjs52 Package: mozjs68 Package: mozjs78 Package: mozjs91 Package: thunderbird Category: Browsers Ecosystem: Ubuntu

Description

Site isolation issue in the DOM: Web Authentication component. This vulnerability was fixed in Firefox 158 and Thunderbird 158.

Affected products

VendorProductAffectedFixed
Mozilla Firefox — 158
Mozilla Thunderbird — 158

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 24.04 LTS mozjs102 +1 No fix yet —
Ubuntu 22.04 LTS mozjs78 +3 No fix yet —
Ubuntu 20.04 LTS mozjs52 +1 No fix yet —
Ubuntu 18.04 LTS mozjs38 +1 No fix yet —

openSUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed MozillaFirefox 158.0-1.1 openSUSE-SU-2026:12190-1

Advisories 2

References