CVE-2026-109775

Executive Summary

CVE-2026-109775 is a denial-of-service vulnerability in the WebRTC component of Mozilla Firefox. The flaw was addressed in Firefox 158 and Firefox ESR 153.5, meaning all earlier releases of the Firefox desktop browser and the Firefox Extended Support Release branch remain affected. Successful exploitation results in a denial of service (browser crash or resource exhaustion) rather than code execution, data disclosure, or integrity compromise; the practical impact is loss of availability for users relying on WebRTC-based real-time communications in the browser.

Technical Analysis

The vulnerability resides in Firefox's WebRTC component — the browser subsystem responsible for real-time audio, video, and data channel communication (Real-Time Communication). WebRTC is exposed to untrusted input by design: a browser session establishes peer connections through signaling that can be initiated by any remote web page, and media/data flows carry attacker-controlled packet streams, SDP offers/answers, ICE candidates, and codec payloads.

Per the NVD description, the defect is classified as a denial-of-service issue. The description does not disclose the specific function, class, message type, or codec path involved, and no CNA title was provided. Consequently, the precise code-level trigger cannot be stated without fabrication. What can be asserted from the available data:

• The flaw is reachable through the WebRTC component, i.e., an availability-impacting condition triggered by processing WebRTC-related input.
• It was severe enough to warrant a fix in both the standard release channel (Firefox 158) and the ESR channel (Firefox ESR 153.5), indicating it was treated as a security-relevant bug in a supported, longer-lived branch.
• The impact is confined to availability. There is no description-based evidence of memory corruption leading to code execution, no information disclosure indication, and no privilege boundary crossing described.

The most plausible mechanism class, consistent with a WebRTC DoS that does not involve code execution, is resource exhaustion or an unhandled/assertion-triggering state reached when malformed or adversarial WebRTC session data is processed — for example, abnormal SDP negotiation, malformed RTP/RTCP or data-channel traffic, or a state-machine inconsistency that causes excessive CPU, memory, or a hard crash. This mechanism is inferred from the vulnerability class only; the NVD description does not confirm any specific code path, and no function or parameter names can be responsibly attributed.

CWE mapping: the description most closely aligns with CWE-400 (Uncontrolled Resource Consumption). No CWE was provided in the source data, so this is an analytical classification, not a vendor-assigned identifier.

Note on scoring: no CVSS score, vector, or EPSS value was supplied. A representative vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H is offered above as an illustrative availability-only profile consistent with a remotely triggerable browser DoS — it is not an authoritative score and must not be presented as one.

Exploitation Scenarios

No public proof-of-concept, exploit code, or Nuclei template exists for this CVE. The attack chain below is described strictly at the vulnerability-class level, consistent with the NVD description ("denial-of-service in the WebRTC component").

1. Reconnaissance / target identification. An adversary identifies victims running Firefox versions below 158 or Firefox ESR below 153.5. Because the flaw is in a browser component, targeting is done by luring users to attacker-controlled content — there is no need to identify a server-side service. Delivery vectors include a malicious or compromised web page, an injected iframe/ad, or any page that initiates a WebRTC session (including via JavaScript in a normal browsing context).

2. Triggering the flaw class. The attacker causes the victim's browser to enter a WebRTC session and supplies adversarial input through that channel. At the class level, this means crafted session negotiation or media/data traffic designed to drive the WebRTC component into an uncontrolled-resource or crash state. The specific malformed field, message type, or codec trigger is not disclosed in the available intelligence and is not stated here.

3. Payload / execution method. No payload beyond the malformed WebRTC interaction is required. This is not a code-execution vulnerability; the "payload" is the adversarial WebRTC input itself. No memory-corruption primitive, shellcode, or post-exploitation module is indicated.

4. Post-exploitation impact. Impact is limited to denial of service: the affected tab, or the entire browser process, becomes unresponsive or terminates (crash/resource exhaustion). There is no described path to data theft, credential access, lateral movement, or persistence within the host. Persistence of the attack is limited to re-triggering while the user remains on the malicious page or revisits it.

Operational caveats. Because no exploit artifacts exist, detection must focus on behavioral signals (repeated browser crashes, tab crashes correlated with WebRTC usage) rather than signatures of a known payload. Any claim of weaponization, in-the-wild exploitation, or named threat-actor use for this CVE would be unsupported.

Impact Assessment

• Primary impact: Availability. A user's browsing session can be disrupted or terminated, interrupting work, collaboration, and any WebRTC-dependent service (video conferencing, browser-based telephony, peer-to-peer applications) running in that browser.
• Confidentiality / Integrity: No described impact. The description indicates DoS only.
• Blast radius: Individual browser sessions on affected Firefox builds. This is not a server-side or network-infrastructure vulnerability; there is no service to mass-exploit and no lateral movement surface described.
• Scope: Browser process / tab. No privilege escalation or sandbox escape is described; even a renderer crash would be contained by the browser's process model, but a browser-level DoS still degrades endpoint availability from the user's perspective.
• Business relevance: Low-to-moderate. Affected enterprises include any organization standardizing on Firefox < 158 or Firefox ESR < 153.5, particularly those in regulated or high-availability environments where ESR is deployed for predictable maintenance. Forced browser restarts can interrupt authenticated sessions and unsaved work.
• Scoring context: No authoritative CVSS or EPSS value is available; the illustrative vector above reflects a network-reachable, no-privilege, no-interaction-complexity availability-only condition, which should be treated as an unconfirmed analytical profile. CISA KEV status is NO.

Detection Guidance

Detection is constrained by the absence of a public exploit and of any disclosed code path. Rules below target behavioral and network-level indicators of WebRTC-based availability attacks and must be tuned in each environment; they are heuristic and are not confirmed signatures of CVE-2026-109775.

Sigma Rule

title: Suspected WebRTC Denial-of-Service in Mozilla Firefox
id: 5f7c2b41-9d3a-4e88-b1c6-77a0e4d9c512
status: experimental
description: Detects repeated Firefox process or tab crashes consistent with a WebRTC-triggered denial of service (CVE-2026-109775 class). Heuristic; not a confirmed signature.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-109775
author: valtersit.com
date: 2026/01/01
tags:
  - attack.t1499
logsource:
  product: windows
  category: application
  service: application
detection:
  selection_firefox_crash:
    Provider_Name: 'Application Error'
    Image|endswith:
      - '\firefox.exe'
  selection_crash_module:
    Message|contains:
      - 'firefox.exe'
      - 'xul.dll'
      - 'mozavcodec.dll'
      - 'nss3.dll'
  timeframe: 5m
  condition: selection_firefox_crash and selection_crash_module
fields:
  - User
  - Image
  - FaultingModule
falsepositives:
  - Legitimate Firefox crashes unrelated to WebRTC
  - Unstable extensions or plugin-related crashes
level: low

YARA Rule

rule EXPL_WebRTC_DoS_Page_CVE_2026_109775
{
    meta:
        description = "Heuristic detection of HTML/JS pages initiating WebRTC sessions, potentially used to trigger a WebRTC DoS (CVE-2026-109775 class). Low-fidelity hunting rule."
        author = "valtersit.com"
        date = "2026-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-109775"
        status = "experimental"

    strings:
        $webrtc1 = "RTCPeerConnection" ascii nocase
        $webrtc2 = "webkitRTCPeerConnection" ascii nocase
        $webrtc3 = "createDataChannel" ascii nocase
        $webrtc4 = "createOffer" ascii nocase
        $webrtc5 = "setRemoteDescription" ascii nocase
        $sdp    = "v=0" ascii
        $sdp2   = "m=application" ascii
        $autoplay = "obfuscated" ascii nocase

    condition:
        (3 of ($webrtc*)) and (1 of ($sdp*))
}

Suricata IDS Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"EXPLOIT-CLASS Possible WebRTC Session Initiation to External Peer (CVE-2026-109775 heuristic)"; flow:to_server,established; content:"POST"; http_method; content:"application/sdp"; http_content_type; classtype:attempted-dos; reference:cve,2026-109775; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-109775; sid:900109775; rev:1;)

Elastic Detection

sequence by process.entity_id with maxspan=5m
  [process where event.type == "start" and process.name : "firefox*"]
  [process where event.type == "end" and process.name : "firefox*" and
   (process.exit_code != 0 or process.exit_code == null)]

Splunk SPL Query

index=windows source="WinEventLog:Application" Provider_Name="Application Error" OR Provider_Name="Windows Error Reporting"
| search firefox.exe OR xul.dll OR mozavcodec.dll
| stats count values(FaultingModule) as Modules by host, User
| where count >= 3
| sort - count

Wazuh OSSEC Rule

<group name="firefox,webrtc,denial_of_service,">
  <rule id="109775" level="5">
    <if_sid>61600</if_sid>
    <field name="win.system.providerName">Application Error</field>
    <match>firefox.exe</match>
    <description>CVE-2026-109775 heuristic: Firefox application crash possibly linked to WebRTC denial of service</description>
    <mitre>
      <id>T1499</id>
    </mitre>
    <group>windows_crash,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED (no patch evidence corroborated by any tracked source). The NVD description states the vulnerability was fixed in Firefox 158 and Firefox ESR 153.5, but no vendor advisory, commit, or changelog was supplied to independently verify that fix. Treat these version numbers as the vendor-stated fixed releases and verify against Mozilla's official security advisories before relying on them.

1) Immediate mitigations (until upgrade is validated):

• Upgrade Firefox to 158 or later, and Firefox ESR to 153.5 or later, as stated in the NVD description. This is the primary and preferred remediation.
• Where immediate upgrade is not possible, restrict browsing of untrusted content: enforce enterprise URL allow-listing, block uncategorized domains, and disable autoplay.
• Review whether WebRTC is required for the user population. If not, disabling WebRTC via enterprise policy (media.peerconnection.enabled is the well-known preference) removes the attack surface entirely — verify the exact policy key in Mozilla's enterprise policy documentation for the deployed version before rollout.
• Deploy DNS/proxy filtering to reduce exposure to drive-by WebRTC initiation from low-reputation sites.

2) Patch / upgrade steps:

• Validate the fixed versions against Mozilla's security advisories for Firefox 158 and Firefox ESR 153.5 (see References).
• Identify hosts running Firefox < 158 or ESR < 153.5 via software inventory (e.g., Shodan/asset management for exposed endpoints, endpoint agents for managed fleets).
• Stage the upgrade, then verify version post-upgrade using about:support or package inventory.
• For ESR deployments, confirm the ESR maintenance cadence and schedule the 153.5 rollout within the standard change window.

3) Long-term hardening:

• Maintain an automated browser update/patch pipeline with defined SLAs for availability-impacting fixes.
• Track Mozilla Security Advisories and MFSA bulletins as a standing intelligence feed.
• Onboard browsers into the KEV/EPSS monitoring process and apply the same priority logic used for server-side software.
• Collect and correlate browser crash telemetry (WER/Application Error logs) to detect recurring, potentially exploitable crash patterns across the fleet.

References

1. NVD — CVE-2026-109775: https://nvd.nist.gov/vuln/detail/CVE-2026-109775
2. Mozilla Security Advisories (MFSA index): https://www.mozilla.org/en-US/security/advisories/
3. Mozilla Firefox ESR release notes: https://www.mozilla.org/en-US/firefox/enterprise/
4. CISA Known Exploited Vulnerabilities Catalog (status for this CVE: not listed): https://www.cisa.gov/known-exploited-vulnerabilities-catalog
5. MITRE ATT&CK T1499 — Endpoint Denial of Service: https://attack.mitre.org/techniques/T1499/

Threat actor / exploitation-in-the-wild status: None reported. No public PoC, no exploit code, no Nuclei template, and no CISA KEV listing exist for CVE-2026-109775 as of the intelligence available for this report.