CVE-2026-109741: Use-after-free in the Storage: Bucket File System component
Use-after-free in the Storage: Bucket File System component. This vulnerability was fixed in Firefox 158 and Firefox ESR 153.5.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 158 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 153.5 - Upgrade
Upgrade
Firefoxto a version that resolves this vulnerability.Fixed in 158 - Upgrade
Upgrade
Firefox ESRto a version that resolves this vulnerability.Fixed in 153.5
Event History
Peer vulnerabilities
Found alongside the following vulnerabilities.
- CVE-2026-109704
- CVE-2026-109705
- CVE-2026-109706
- CVE-2026-109707
- CVE-2026-109708
- CVE-2026-109709
- CVE-2026-109710
- CVE-2026-109711
- CVE-2026-109712
- CVE-2026-109713
- CVE-2026-109714
- CVE-2026-109715
- CVE-2026-109716
- CVE-2026-109717
- CVE-2026-109718
- CVE-2026-109719
- CVE-2026-109720
- CVE-2026-109721
- CVE-2026-109722
- CVE-2026-109723
- CVE-2026-109724
- CVE-2026-109725
- CVE-2026-109726
- CVE-2026-109727
- CVE-2026-109728
- CVE-2026-109729
- CVE-2026-109730
- CVE-2026-109731
- CVE-2026-109732
- CVE-2026-109733
- CVE-2026-109734
- CVE-2026-109735
- CVE-2026-109736
- CVE-2026-109737
- CVE-2026-109738
- CVE-2026-109739
- CVE-2026-109740
- CVE-2026-109741
- CVE-2026-109742
- CVE-2026-109743
- CVE-2026-109744
- CVE-2026-109745
- CVE-2026-109746
- CVE-2026-109747
- CVE-2026-109748
- CVE-2026-109749
- CVE-2026-109750
- CVE-2026-109751
- CVE-2026-109752
- CVE-2026-109753
- CVE-2026-109754
- CVE-2026-109755
- CVE-2026-109756
- CVE-2026-109757
- CVE-2026-109759
- CVE-2026-109760
- CVE-2026-109761
- CVE-2026-109762
- CVE-2026-109763
- CVE-2026-109764
- CVE-2026-109765
- CVE-2026-109766
- CVE-2026-109767
- CVE-2026-109768
- CVE-2026-109769
- CVE-2026-109770
- CVE-2026-109771
- CVE-2026-109772
- CVE-2026-109773
- CVE-2026-109774
- CVE-2026-109775
- CVE-2026-109776
- CVE-2026-109777
- CVE-2026-109778
- CVE-2026-109779
- CVE-2026-109780
- CVE-2026-109781
- CVE-2026-109782
- CVE-2026-109783
Frequently Asked Questions
Does exploitation require an authenticated account?
No. The CVSS vector indicates that no privileges are required.
Is user interaction required for exploitation?
Yes. The CVSS vector indicates that user interaction is required.
What security impact is indicated?
The vulnerability is rated medium severity with a CVSS 3.1 score of 5.4. It may result in low-impact confidentiality and integrity compromise, with no availability impact indicated.