CVE-2026-109763: Mitigation bypass in the File Handling component

Affected Software

Remediation

Recommended actions to resolve this vulnerability, in priority order.

1. Upgrade

   Upgrade to a fixed release to a version that resolves this vulnerability.

   Fixed in 153.5
2. Upgrade

   Upgrade to a fixed release to a version that resolves this vulnerability.

   Fixed in 158
3. Upgrade

   Upgrade debian/firefox-esr to a version that resolves this vulnerability.

   Fixed in 153.5.0esr-1~deb12u1
4. Upgrade

   Upgrade debian/firefox-esr to a version that resolves this vulnerability.

   Fixed in 153.5.0esr-1~deb13u1
5. Upgrade

   Upgrade debian/firefox-esr to a version that resolves this vulnerability.

   Fixed in 153.5.0esr-1
6. Upgrade

   Upgrade debian/thunderbird to a version that resolves this vulnerability.

   Fixed in 1:153.5.1esr-1~deb12u1
7. Upgrade

   Upgrade debian/thunderbird to a version that resolves this vulnerability.

   Fixed in 1:153.5.1esr-1~deb13u1
8. Upgrade

   Upgrade debian/thunderbird to a version that resolves this vulnerability.

   Fixed in 1:153.5.0esr-1
9. Upgrade

   Upgrade debian/firefox to a version that resolves this vulnerability.

   Fixed in 159.0-1
10. Upgrade

    Upgrade debian/firefox-esr to a version that resolves this vulnerability.

    Fixed in 153.6.0esr-1~deb12u2Fixed in 153.6.0esr-1~deb13u1Fixed in 153.5.1esr-1Fixed in 153.6.0esr-1
11. Upgrade

    Upgrade debian/thunderbird to a version that resolves this vulnerability.

    Fixed in 1:153.6.0esr-1~deb12u2Fixed in 1:153.6.0esr-1~deb13u1Fixed in 1:153.5.0esr-1Fixed in 1:153.6.0esr-1
12. Upgrade

    Upgrade Firefox to a version that resolves this vulnerability.

    Fixed in 158
13. Upgrade

    Upgrade Firefox ESR to a version that resolves this vulnerability.

    Fixed in 153.5
14. Upgrade

    Upgrade Thunderbird to a version that resolves this vulnerability.

    Fixed in 158
15. Upgrade

    Upgrade Thunderbird to a version that resolves this vulnerability.

    Fixed in 153.5

Event History

Parent advisories

This vulnerability appears in the following advisories.

• MFSA2026-110
• MFSA2026-106
• MFSA2026-108
• MFSA2026-109
• DSA-6560
• DSA-6585

Peer vulnerabilities

Found alongside the following vulnerabilities.

• CVE-2026-110249
• CVE-2026-109704
• CVE-2026-109705
• CVE-2026-109706
• CVE-2026-109707
• CVE-2026-109708
• CVE-2026-109709
• CVE-2026-109710
• CVE-2026-109711
• CVE-2026-109712
• CVE-2026-109713
• CVE-2026-109715
• CVE-2026-109716
• CVE-2026-109717
• CVE-2026-109718
• CVE-2026-109719
• CVE-2026-109720
• CVE-2026-109721
• CVE-2026-109722
• CVE-2026-109723
• CVE-2026-109724
• CVE-2026-109725
• CVE-2026-109726
• CVE-2026-109727
• CVE-2026-109728
• CVE-2026-109729
• CVE-2026-109730
• CVE-2026-109731
• CVE-2026-109732
• CVE-2026-109733
• CVE-2026-109734
• CVE-2026-109736
• CVE-2026-109737
• CVE-2026-109738
• CVE-2026-109740
• CVE-2026-109741
• CVE-2026-109742
• CVE-2026-109743
• CVE-2026-109744
• CVE-2026-109745
• CVE-2026-109782
• CVE-2026-109751
• CVE-2026-109752
• CVE-2026-109753
• CVE-2026-109754
• CVE-2026-109756
• CVE-2026-109757
• CVE-2026-109759
• CVE-2026-109760
• CVE-2026-109762
• CVE-2026-109763
• CVE-2026-109764
• CVE-2026-109765
• CVE-2026-109766
• CVE-2026-109767
• CVE-2026-109783
• CVE-2026-109770
• CVE-2026-109775
• CVE-2026-109776
• CVE-2026-109777
• CVE-2026-109778
• CVE-2026-109781
• CVE-2026-109714
• CVE-2026-109735
• CVE-2026-109739
• CVE-2026-109746
• CVE-2026-109747
• CVE-2026-109748
• CVE-2026-109749
• CVE-2026-109750
• CVE-2026-109755
• CVE-2026-109761
• CVE-2026-109768
• CVE-2026-109769
• CVE-2026-109771
• CVE-2026-109772
• CVE-2026-109773
• CVE-2026-109774
• CVE-2026-109779
• CVE-2026-109780
• CVE-2026-110247
• CVE-2026-106016
• DLA-4836-1
• DLA-4863-1

Frequently Asked Questions