Denial-of-Service in Firefox Site Reports

Executive Summary

CVE-2026-109768 is a denial-of-service vulnerability in Firefox's Site Reports component. It allows the URL in the address bar to remain unchanged after clicking certain buttons, such as the 'Connect' button on p3x.redis.patrikx3.com. This prevents users from manually editing the URL or navigating to other websites.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves a UI spoofing issue where the URL in the address bar cannot be changed after interacting with a specific site. To detect it, check if your Firefox version is below 158. Use the about:support page in Firefox to verify the version. If you observe unexpected URL behavior on p3x.redis.patrikx3.com or similar sites, the issue may be present.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability could disrupt normal browsing by trapping users on a specific webpage. They would be unable to change the URL or access other sites, leading to a degraded user experience. It may also cause confusion or frustration as navigation controls become unresponsive.

Useful 0 Not Useful 0

Mitigation Strategies

Update Firefox to version 158 or later immediately. This resolves the vulnerability by fixing the navigation issue. If updating is not possible, avoid interacting with untrusted websites that may trigger this behavior.

Useful 0 Not Useful 0