CVE-2026-109774

Received Received - Intake

Invalid Pointer Dereference in Firefox DOM Notifications

Publication date: 2026-10-13

Last updated on: 2026-10-26

Assigner: Mozilla Corporation

Description

Invalid pointer, undefined behavior in the DOM: Notifications component. This vulnerability was fixed in Firefox 158 and Thunderbird 158.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-13

Last Modified

2026-10-26

Generated

2026-11-08

AI Q&A

2026-10-13

EPSS Evaluated

2026-11-07

NVD

CVE-2026-109774

EUVD

EUVD-2026-98534

Affected Vendors & Products

Vendor	Product	Version / Range
mozilla	firefox	158

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-824	The product accesses or uses a pointer that has not been initialized.

Attack-Flow Graph

Executive Summary

CVE-2026-109774 is a low-severity vulnerability in Mozilla Firefox causing a null dereference crash in the Notification component. It occurs when a non-persistent notification with an icon is created, triggering an asynchronous icon fetch. If the page is frozen, the notification's actor is destroyed but the mIsClosed flag remains false, leading to a crash when attempting to send a show message through the invalid actor.

Detection Guidance

This vulnerability is specific to Firefox's DOM Notifications component and may cause crashes. Check Firefox version with 'firefox --version'. If using version below 158, the system is vulnerable. Monitor for segmentation faults in notification-related processes.

Impact Analysis

This vulnerability could cause Firefox to crash when handling certain notifications, potentially leading to denial of service. Users might experience unexpected application termination when interacting with web pages that trigger notifications with icons.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards. It is a low-severity crash issue in Firefox's DOM Notifications component that could lead to denial-of-service conditions but does not involve data exposure or unauthorized access.

Mitigation Strategies

Upgrade Firefox to version 158 or later immediately. Disable non-persistent notifications with icons if immediate upgrade isn't possible. Monitor crash logs for notification-related segmentation faults.

Hi! I’m here to help you understand CVE-2026-109774. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...