CVE-2026-109739

Summary

A privilege escalation vulnerability in Firefox and Thunderbird's WebExtensions component allows authenticated users to gain elevated privileges, potentially leading to full system compromise. This affects both browsers and email clients from version 158 and earlier.

Exploitability

Exploitation requires an authenticated user session with access to the WebExtensions API, making it moderately difficult but possible with social engineering or compromised accounts.

Blast radius

If exploited, this vulnerability could allow attackers to execute arbitrary code with elevated privileges, potentially leading to complete system compromise across multiple platforms including Windows, macOS, and Linux.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to Firefox 158 or Thunderbird 158 immediately, as these versions contain the necessary patches for this privilege escalation vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.