CVE-2026-109715
Incorrect boundary conditions in the JavaScript Engine component.
Published Oct 13, 2026 · updated Oct 15, 2026
Incorrect boundary conditions in the JavaScript Engine component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.
Timeline
Detection, updates, and resolution for this record.
Oct 13, 2026 · OSV.dev
Detected
Incorrect boundary conditions in the JavaScript Engine component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.
Oct 15, 2026 · OSV.dev
Fix available
firefox-esr fixed in 153.5.0esr-1~deb12u1; firefox-esr fixed in 153.5.0esr-1~deb13u1
Oct 15, 2026 · OSV.dev
Fix available
firefox-esr fixed in 153.5.0esr-1~deb12u1
Oct 15, 2026 · OSV.dev
Fix available
firefox-esr fixed in 153.5.0esr-1~deb13u1
Oct 15, 2026 · OSV.dev
Updated
Incorrect boundary conditions in the JavaScript Engine component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.
Affected
- Debian:12 firefox-esr0 → 153.5.0esr-1~deb12u1
- Debian:12 thunderbird1:102.11.0-1, 1:102.12.0-1, 1:102.12.0-1~deb10u1
- Debian:13 firefox-esr0 → 153.5.0esr-1~deb13u1
- Debian:13 thunderbird1:128.13.0esr-1, 1:128.14.0esr-1, 1:128.14.0esr-1~deb11u1
- Debian:14 firefox-esr128.13.0esr-1, 128.14.0esr-1, 128.14.0esr-1~deb11u1
- Debian:14 thunderbird1:128.13.0esr-1, 1:128.14.0esr-1, 1:128.14.0esr-1~deb11u1