External risk intelligence

Firefox and Thunderbird DOM Notifications Invalid Pointer Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-109774

This vulnerability exists within the DOM Notifications component of a web browser and email client. Such components are client-side features executed locally within the application on a user's device. They are not network-facing services, gateways, or infrastructure components, and therefore do not have a public internet-facing attack surface in common deployments.

Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in the DOM: Notifications component, affecting Firefox and Thunderbird. This issue could potentially allow for significant compromise of confidentiality, integrity, and availability. The primary concern is to confirm if our deployed applications or user base are exposed to this vulnerability, as the affected component is client-side.

Unchecked code can crash browsers and email clients.
It impacts widely used applications like Firefox and Thunderbird.
Assess relevance to confirm potential exposure.

Attack Path

How an attacker could exploit the issue

An attacker could reach this vulnerability by tricking a user into visiting a malicious webpage. This would involve the vulnerable DOM: Notifications component, leading to potential data corruption or system compromise.

No authentication or special access needed.
Triggered by user visiting a malicious website.
Allows for high impact on confidentiality, integrity, and availability.

Live Threat

Current exploitation, exposure, and threat context

In systems utilizing the DOM: Notifications component, an invalid pointer and undefined behavior could lead to the compromise of sensitive information and service disruption. This may occur when the component is accessed under specific, yet unsupported by the advisory, conditions.

System data could be at risk.
Exposure may happen via the component.
Unauthorized access or service disruption.

Operational Fix

Recommended remediation, mitigation, and detection steps

Technical leaders and application owners should prioritize identifying all instances of the affected Firefox and Thunderbird deployments. The initial focus should be on confirming network reachability and business criticality to inform risk-based remediation planning, which may involve coordination with vendor management if direct patching is not immediately feasible.

Identify affected deployments and ownership.
Verify network exposure and business impact.
Plan coordinated remediation or risk reduction.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the DOM: Notifications component in Firefox and Thunderbird?

This component manages how your browser or email client displays alert messages from websites and services. It acts as the bridge between web content and your system's notification framework, ensuring that pop-up alerts appear correctly. Because it interacts directly with web-delivered data, it must carefully track where information is stored in memory to maintain system stability.

What does CWE-824 mean for CVE-2026-109774?

CWE-824 refers to accessing an uninitialized pointer. In simple terms, the software tries to use a piece of computer memory that has not been properly prepared or assigned to a specific task. Because the application does not know what data exists at that location, it creates undefined behavior. For this CVE, this memory error can lead to a critical crash or allow unauthorized control over the application.

How is this vulnerability triggered?

An attacker triggers this flaw by luring a user to a malicious website or a page designed to manipulate notification requests. Simply running the application is not enough to trigger the bug; the software must actively process a specially crafted notification instruction from the malicious site. If a user does not visit an untrusted or compromised site, the component remains idle and the condition is not met.

Does my organization have a public attack surface for this?

According to Halo Surface Signal, this vulnerability exists within client-side software on a user's device rather than on a public-facing network gateway. Because the risk relies on a user navigating to a malicious site, it is not a traditional network-facing service issue. Your exposure depends on your users' web browsing habits rather than the presence of internet-exposed server infrastructure.

How do I respond to CVE-2026-109774?

The most effective first step is to inventory where Firefox and Thunderbird are installed in your environment. Once identified, ensure your update management processes are current, as this vulnerability is resolved in version 158 of both products. Focus your efforts on confirming that users are running the patched software versions to eliminate the underlying memory error.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.