CVE-2026-109744

Executive Summary

CVE-2026-109744 is an unclassified "other issue" affecting the DOM: File component of Mozilla Firefox, as described by the NVD. The vulnerability is fixed in Firefox 158 and Firefox ESR 153.5, meaning all Firefox builds prior to those versions—plus ESR builds prior to 153.5—are potentially affected. The precise security impact cannot be determined from the available NVD description; no CVSS score, CWE classification, public PoC, or exploit code has been published, so the report characterizes the issue by vulnerability class and component rather than confirmed exploit mechanics.

Technical Analysis

This CVE targets a flaw in the DOM: File component of the Mozilla Firefox browser. The DOM: File component is the part of Gecko (Firefox's rendering/layout engine) that implements the File API surface exposed to web content—objects and interfaces that allow JavaScript running in a page to represent, read metadata about, and access user-selected or programmatically constructed files (File, FileList, Blob, FileReader, and the associated DOM plumbing). An "other issue" of this nature typically corresponds to a logic, validation, or lifetime defect rather than a textbook memory-safety bug, though Gecko component bugs frequently also have memory-corruption consequences.

What the available data supports:

• The affected surface is exposed to web content; the DOM: File interfaces are reachable from any page loaded in the browser, which means the attack surface is the standard web-content attack surface of Gecko.
• The vendor considered the issue important enough to fix it in both the current channel (Firefox 158) and the ESR branch (Firefox ESR 153.5), indicating it affects the supported enterprise branch as well.
• The NVD classifies it as "other issue," which means the CNA did not map it to a specific weakness type in the data provided; no CWE is assigned in the source.

What the available data does NOT support:

• The specific defect class (e.g., improper access control on file handles, cross-origin read exposure via file/blob APIs, memory corruption in a DOM: File code path) cannot be determined from the supplied description.
• No function, class, method, URL, or parameter names appear in the source data, so no implementation-level detail can be stated without fabrication.
• No CVSS vector or score, no exploitability metrics, and no EPSS estimate exist in the supplied data.

Assessment: Treat this as an undocumented-severity Gecko DOM: File defect. The most probable impact classes for this component are (a) disclosure of file content or file metadata that should not be readable by the requesting origin, and (b) memory safety violation reachable from scripted manipulation of File/Blob objects. Both require a user to load attacker-influenced web content in an affected browser version. Because no confirmation is available, detection should focus on the exploitation pattern (abnormal scripted file-API activity and browser process compromise indicators) rather than on a known signature.

Exploitation Scenarios

No public proof-of-concept exists for CVE-2026-109744; the exploit chain below is inferred at the vulnerability-class level and must be treated as hypothetical until a vendor advisory or researcher write-up provides specifics.

1. Reconnaissance / target identification. An adversary hosts a page that is loaded by a victim using an affected Firefox build (any version below 158, or ESR below 153.5). Delivery vectors are the usual web-content channels: malicious or compromised websites, injected third-party content, or ad networks. Because the flaw is in the DOM: File component, the page does not need elevated privileges—ordinary web content is sufficient to reach the attack surface.

2. Triggering the flaw. The page executes JavaScript that exercises the DOM: File APIs. The exact trigger depends on the underlying defect, which is not disclosed. At the class level, the attacker manipulates file-related DOM objects (for example, by supplying crafted input to the File API surface the victim's browser processes) to reach the vulnerable code path. No user interaction beyond browsing the crafted page is assumed unless the defect itself requires a file-selection gesture; that cannot be determined from the available data.

3. Payload / execution method. If the defect is a disclosure issue, the payload is script that reads data the same-origin policy should have blocked and exfiltrates it to an attacker-controlled endpoint. If the defect is memory-safety related, the payload is script that drives the vulnerable DOM: File path until memory corruption occurs, then attempts code execution inside the browser's content process. Neither outcome is confirmed by the source data.

4. Post-exploitation impact. For a disclosure defect: loss of confidentiality for data the browser can access under the victim's session. For a memory-corruption defect: arbitrary code execution within the Firefox content process sandbox, with the possibility of sandbox escape only through additional, separate vulnerabilities. Given that both release and ESR branches required fixes, enterprise fleets running ESR are in scope.

Impact Assessment

• CVSS: No score or vector is available in the supplied data. Impact subscore, exploitability subscore, attack vector, and privileges-required values are all undetermined. Do not infer a severity rating from third-party sources.
• EPSS: Not yet scored by FIRST.org; no probability estimate can be cited.
• CWE: Not assigned in the source data.
• Exploitation status: No public PoC, no exploit code, and no Nuclei template known. CISA KEV status: NO.
• Affected systems: Firefox builds below 158 and Firefox ESR builds below 153.5. Enterprise environments with managed ESR deployments, kiosk browsers, and BYOD endpoints are the primary blast-radius concern.
• Business impact: Potentially ranging from information disclosure of user-accessible file data to client-side code execution, contingent on the undisclosed defect class. Because the vulnerability class is unconfirmed, risk owners should treat remediation as time-sensitive but calibrate urgency against the absence of known exploitation.

Detection Guidance

Sigma Rule

title: Firefox DOM File Component Exploitation - Suspicious Content Process Behavior
id: 8f2c1e6a-4b7d-4e9a-9c3f-2a5d6e7f8b90
status: experimental
description: Detects anomalous Firefox content-process crashes/restarts and child process spawns that may indicate exploitation of a DOM File component defect (CVE-2026-109744).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-109744
author: valtersit.com
date: 2026-01-01
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\firefox.exe'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
  filter_update:
    CommandLine|contains:
      - 'default-browser-agent'
      - 'updater.exe'
  condition: selection_parent and selection_child and not filter_update
falsepositives:
  - Legitimate enterprise extensions launching helper processes
level: medium
tags:
  - attack.t1190
  - cve.2026-109744

YARA Rule

rule EXPLOIT_Firefox_DOM_File_CVE_2026_109744
{
    meta:
        description = "Detects HTML/JS content abusing Firefox DOM File APIs consistent with CVE-2026-109744 exploitation attempts"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-109744"
        date = "2026-01-01"
        severity = "medium"
    strings:
        $a1 = "FileReader" ascii
        $a2 = "createObjectURL" ascii
        $a3 = "webkitRequestFileSystem" ascii
        $a4 = "readAsArrayBuffer" ascii
        $a5 = "readAsDataURL" ascii
        $b1 = "new Blob(" ascii
        $b2 = "new File(" ascii
        $c1 = "XMLHttpRequest" ascii
        $c2 = "fetch(" ascii
        $c3 = "navigator.sendBeacon" ascii
    condition:
        uint16be(0) != 0x4D5A and
        filesize < 2MB and
        2 of ($a*) and
        1 of ($b*) and
        1 of ($c*)
}

Suricata IDS Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"EXPLOIT Firefox DOM File Component Data Exfiltration Attempt CVE-2026-109744"; flow:established,to_server; http.method; content:"POST"; http.header; content:"User-Agent|3a 20|Mozilla/5.0"; http.header; content:"Firefox/"; pcre:"/Firefox\/(?:1[0-4][0-9]|15[0-7])(?:\.| )/R"; threshold:type both, track by_src, count 3, seconds 60; classtype:attempted-user; sid:2026109744; rev:1; metadata:reference cve,2026-109744;)

Elastic Detection

process where event.type == "start" and
  process.parent.name in ("firefox", "firefox-esr") and
  process.name in ("cmd.exe", "powershell.exe", "wscript.exe", "cscript.exe", "mshta.exe", "sh", "bash", "curl", "wget")

Splunk SPL Query

index=endpoint OR index=sysmon EventCode=1
| eval parent=lower(ParentImage), child=lower(Image)
| where (like(parent,"%firefox.exe%") OR like(parent,"%firefox%"))
| where (like(child,"%cmd.exe%") OR like(child,"%powershell.exe%") OR like(child,"%wscript.exe%") OR like(child,"%cscript.exe%") OR like(child,"%mshta.exe%") OR like(child,"%bash%") OR like(child,"%curl%"))
| stats count min(_time) as first_seen max(_time) as last_seen by host, user, ParentImage, Image, CommandLine
| where count < 20
| convert ctime(first_seen) ctime(last_seen)
| sort - first_seen

Wazuh OSSEC Rule

<group name="firefox,exploit,cve-2026-109744,">
  <rule id="100744" level="10">
    <if_sid>18104</if_sid>
    <field name="win.parentImage">firefox.exe</field>
    <field name="win.image">cmd.exe|powershell.exe|wscript.exe|cscript.exe|mshta.exe</field>
    <description>CVE-2026-109744: Suspicious child process spawned by Firefox - possible DOM File component exploitation</description>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
  <rule id="100745" level="8">
    <if_sid>550</if_sid>
    <match>firefox</match>
    <description>CVE-2026-109744: Firefox-related file modification observed - review for version downgrade or tampering</description>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). The NVD description states the issue is fixed in Firefox 158 and Firefox ESR 153.5, but no vendor advisory, changelog entry, or patch source is present in the tracked data to corroborate a patch reference.

1. Immediate mitigations

   • Update Firefox to version 158 or later, and Firefox ESR to version 153.5 or later, per the fix versions stated in the NVD description.
   • Where updates cannot be deployed immediately, reduce exposure by enforcing strict content blocking, disabling unnecessary extensions, and applying network-level filtering of untrusted script content.
   • Monitor browser crash telemetry; repeated content-process crashes in a managed fleet are a potential precursor to exploit attempts.

2. Patch / upgrade steps

   • Inventory all Firefox installations, including ESR deployments and embedded or kiosk browsers, and verify current versions programmatically.
   • Prioritize ESR endpoints used for business-critical or privileged access.
   • Verify the update channel is receiving version 158 / ESR 153.5 or higher and re-verify post-deployment.

3. Long-term hardening

   • Enable automatic browser updates and centralize version reporting for all managed endpoints.
   • Enforce site isolation and strict same-origin controls where configurable.
   • Require user confirmation for file access prompts and limit untrusted sites' ability to reach local resources where policy allows.
   • Track Mozilla security advisories and ESR release schedules so ESR-based fleets are remediated in step with the current channel.

References

• NVD — CVE-2026-109744: https://nvd.nist.gov/vuln/detail/CVE-2026-109744
• Mozilla Foundation Security Advisories (Firefox release notes for version 158 and ESR 153.5): https://www.mozilla.org/en-US/security/advisories/
• Mozilla Firefox ESR release channel and download verification: https://www.mozilla.org/en-US/firefox/enterprise/
• FIRST EPSS (CVE-2026-109744 currently unscored): https://www.first.org/epss/
• CISA Known Exploited Vulnerabilities Catalog (CVE-2026-109744 not listed): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No known threat actor campaigns or exploit-in-the-wild evidence are associated with CVE-2026-109744 in the supplied data.