cbcvebase.
CVE-2026-109745
published 2026-10-13

CVE-2026-109745: Sandbox escape due to uninitialized memory in the DOM: Web Serial component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158…

PriorityP423
EPSS
0.16%
4.6th percentile
Sandbox escape due to uninitialized memory in the DOM: Web Serial component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.

Affected

4 ranges
VendorProductVersion rangeFixed in
mozillafirefox< Firefox 158Firefox 158
mozillafirefox_esr< Firefox ESR 153.5Firefox ESR 153.5
mozillathunderbird< Thunderbird 153.5Thunderbird 153.5
mozillathunderbird< Thunderbird 158Thunderbird 158
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.