Patchwire CVEs, their patch status, and feeds to follow them

CVE-2026-109735

Fixed in a distro release EPSS <1%CVSS 5.4

Use-after-free in the DOM: Animation component. This vulnerability was fixed in Firefox 158 and Thunderbird 158.

Published 2026-10-13 · CVE record · OSV

Products: Mozilla Firefox, Mozilla Thunderbird

Distro releases

ReleasePackageFixed in
Ubuntu:18.04:LTSmozjs38no fix
Ubuntu:18.04:LTSmozjs52no fix
Ubuntu:20.04:LTSmozjs52no fix
Ubuntu:20.04:LTSmozjs68no fix
Ubuntu:22.04:LTSmozjs102no fix
Ubuntu:22.04:LTSmozjs78no fix
Ubuntu:22.04:LTSmozjs91no fix
Ubuntu:22.04:LTSthunderbirdno fix
Ubuntu:24.04:LTSmozjs102no fix
Ubuntu:24.04:LTSmozjs115no fix
openSUSE:TumbleweedMozillaFirefox158.0-1.1