ZeroDay Findings
Sign inSign up

Findings

CVE-2026-109776

Race condition in the XPCOM component.

Published Oct 13, 2026 · updated Oct 15, 2026

Race condition in the XPCOM component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.

Timeline

Detection, updates, and resolution for this record.

  1. Oct 13, 2026 · OSV.dev

    Detected

    Race condition in the XPCOM component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.

  2. Oct 15, 2026 · OSV.dev

    Fix available

    firefox-esr fixed in 153.5.0esr-1~deb12u1; firefox-esr fixed in 153.5.0esr-1~deb13u1

  3. Oct 15, 2026 · OSV.dev

    Fix available

    firefox-esr fixed in 153.5.0esr-1~deb12u1

  4. Oct 15, 2026 · OSV.dev

    Fix available

    firefox-esr fixed in 153.5.0esr-1~deb13u1

  5. Oct 15, 2026 · OSV.dev

    Updated

    Race condition in the XPCOM component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.

Affected

  • Debian:12 firefox-esr0 → 153.5.0esr-1~deb12u1
  • Debian:12 thunderbird1:102.11.0-1, 1:102.12.0-1, 1:102.12.0-1~deb10u1
  • Debian:13 firefox-esr0 → 153.5.0esr-1~deb13u1
  • Debian:13 thunderbird1:128.13.0esr-1, 1:128.14.0esr-1, 1:128.14.0esr-1~deb11u1
  • Debian:14 firefox-esr128.13.0esr-1, 128.14.0esr-1, 128.14.0esr-1~deb11u1
  • Debian:14 thunderbird1:128.13.0esr-1, 1:128.14.0esr-1, 1:128.14.0esr-1~deb11u1

Sources

References

CVE-2026-109776 · ZeroDay Findings