{"id":"CVE-2026-109780","published":"2026-10-13T13:17:28Z","modified":"2026-10-26T20:17:47Z","title":"Mitigation bypass in the DOM: Core & HTML component","vendor":"Mozilla","product":"Firefox","tier":"core","eol":null,"description":{"text":"Mitigation bypass in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 158 and Thunderbird 158.","provenance":"source","from":"NVD"},"summary":{"text":"A mitigation bypass in the DOM: Core & HTML component of Mozilla Firefox allows protections implemented in that component to be circumvented. An attacker who can reach the affected browser over the network, without authentication or user interaction, can exploit this flaw.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T07:24:49Z"},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.00363,"percentile":0.3008,"date":"2026-10-29","provenance":"source"},"kev":null,"vulncheckKev":null,"exploited":false,"otx":{"pulseCount":9,"pulses":[{"name":"Known_Cve | Oct 22, 2026 | Part 1/4","url":"https://otx.alienvault.com/pulse/6ad8d340ce8bef7ffa79b89b","created":"2026-10-21"},{"name":"Known_Cve | Oct 21, 2026 | Part 2/4","url":"https://otx.alienvault.com/pulse/6ad7813c340f998d3db4d0bb","created":"2026-10-20"},{"name":"Known_Cve | Oct 20, 2026 | Part 2/4","url":"https://otx.alienvault.com/pulse/6ad62f708ed98220bccde9c8","created":"2026-10-19"},{"name":"Known_Cve | Oct 19, 2026 | Part 2/4","url":"https://otx.alienvault.com/pulse/6ad4ddae89608f8a66f58915","created":"2026-10-18"},{"name":"Known_Cve | Oct 18, 2026 | Part 2/4","url":"https://otx.alienvault.com/pulse/6ad38c2e0aa0d5de6ee8bb52","created":"2026-10-17"},{"name":"Known_Cve | Oct 17, 2026 | Part 2/4","url":"https://otx.alienvault.com/pulse/6ad23ab69d40bd72818ecdae","created":"2026-10-16"},{"name":"Known_Cve | Oct 16, 2026 | Part 2/3","url":"https://otx.alienvault.com/pulse/6ad0e93a078e6220a69919cf","created":"2026-10-15"},{"name":"Known_Cve | Oct 15, 2026 | Part 2/3","url":"https://otx.alienvault.com/pulse/6acf9878b4135e4a2037eb34","created":"2026-10-14"},{"name":"Known_Cve | Oct 14, 2026 | Part 3/3","url":"https://otx.alienvault.com/pulse/6ace46861569c0833e65dba1","created":"2026-10-13"}],"provenance":"machine"},"cwes":[{"id":"CWE-693","name":"Protection Mechanism Failure"}],"references":[{"url":"https://bugzilla.mozilla.org/show_bug.cgi?id=2072775","tags":[]},{"url":"https://www.mozilla.org/security/advisories/mfsa2026-106/","tags":[]},{"url":"https://www.mozilla.org/security/advisories/mfsa2026-109/","tags":[]}],"techniques":[],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2026-98540","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-98540","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":null,"exploitRefs":[],"flow":[],"timeline":[{"date":"2026-10-13","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109780","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":null,"daysToKev":null},"priority":{"score":15.1,"factors":[{"name":"In a KEV catalog","points":0.0,"detail":"not listed"},{"name":"Recent KEV listing","points":0.0,"detail":"not listed"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":6.02,"detail":"percentile 0.3008"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":0.0,"detail":"none found"},{"name":"Mentioned in OTX pulses","points":2.27,"detail":"9 pulses"},{"name":"CVSS severity","points":6.86,"detail":"base score 9.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}