CVE-2026-109774
Received Received - Intake

Invalid Pointer Dereference in Firefox DOM Notifications

Publication date: 2026-10-13

Last updated on: 2026-10-13

Assigner: Mozilla Corporation

Description
Invalid pointer, undefined behavior in the DOM: Notifications component. This vulnerability was fixed in Firefox 158.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-13
Last Modified
2026-10-13
Generated
2026-10-13
AI Q&A
2026-10-13
EPSS Evaluated
N/A
NVD
CVE-2026-109774
EUVD
EUVD-2026-98534

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
mozilla firefox 158

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-109774 is a low-severity vulnerability in Mozilla Firefox causing a null dereference crash in the Notification component. It occurs when a non-persistent notification with an icon is created, triggering an asynchronous icon fetch. If the page is frozen, the notification's actor is destroyed but the mIsClosed flag remains false, leading to a crash when attempting to send a show message through the invalid actor.

Detection Guidance

This vulnerability is specific to Firefox's DOM Notifications component and may cause crashes. Check Firefox version with 'firefox --version'. If using version below 158, the system is vulnerable. Monitor for segmentation faults in notification-related processes.

Impact Analysis

This vulnerability could cause Firefox to crash when handling certain notifications, potentially leading to denial of service. Users might experience unexpected application termination when interacting with web pages that trigger notifications with icons.

Mitigation Strategies

Upgrade Firefox to version 158 or later immediately. Disable non-persistent notifications with icons if immediate upgrade isn't possible. Monitor crash logs for notification-related segmentation faults.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-109774. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart