Vulnerability-Lookup

OESA-2026-4410 (CVE-2026-100756)

Vulnerability from osv_openeuler – Published: 2026-10-16 12:00 – Updated: 2026-10-16 12:00 – Source website

Summary

thunderbird security update

Details

Mozilla Thunderbird is a standalone mail and newsgroup client.

Security Fix(es):

Incorrect boundary conditions in the Audio/Video: Playback component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.(CVE-2026-100756)

Use-after-free in the Widget component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.(CVE-2026-100757)

Sandbox escape in the DOM: Navigation component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.(CVE-2026-100758)

Uninitialized memory in the Storage: Quota Manager component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.(CVE-2026-100759)

Sandbox escape due to use-after-free in the DOM: Content Processes component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.(CVE-2026-100762)

Information disclosure in the Networking: JAR component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.(CVE-2026-100766)

Use-after-free in the Networking: Cache component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.(CVE-2026-100767)

Use-after-free in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, and Firefox ESR 140.17.(CVE-2026-100769)

Undefined behavior in the DOM: Streams component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.(CVE-2026-100771)

Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, and Firefox ESR 140.17.(CVE-2026-100772)

Use-after-free in the Storage: IndexedDB component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.(CVE-2026-100773)

Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.(CVE-2026-100774)

Sandbox escape in the Graphics component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.(CVE-2026-100775)

Use-after-free in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.(CVE-2026-100777)

Sandbox escape due to use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.(CVE-2026-100778)

Use-after-free in the XSLT component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.(CVE-2026-100779)

Sandbox escape due to incorrect boundary conditions in the Graphics: WebRender component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.(CVE-2026-100781)

Privilege escalation due to incorrect boundary conditions in the Graphics component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.(CVE-2026-100782)

Uninitialized memory in the Audio/Video component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.(CVE-2026-100783)

Use-after-free in the Layout: Text and Fonts component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.(CVE-2026-100784)

Sandbox escape due to use-after-free in the Graphics component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.(CVE-2026-100786)

Invalid pointer in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, and Firefox ESR 140.17.(CVE-2026-100788)

JIT miscompilation in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, and Firefox ESR 140.17.(CVE-2026-100792)

Sandbox escape due to incorrect boundary conditions in the Internationalization component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, and Firefox ESR 140.17.(CVE-2026-100794)

Privilege escalation due to use-after-free in the Graphics: WebRender component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.(CVE-2026-100797)

Privilege escalation in the DLL Services component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, and Firefox ESR 140.17.(CVE-2026-100801)

Same-origin policy bypass in the WebExtensions component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.(CVE-2026-100803)

Privilege escalation in the DOM: Service Workers component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, and Firefox ESR 140.17.(CVE-2026-100807)

Sandbox escape due to use-after-free in the Widget: Gtk component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, and Firefox ESR 140.17.(CVE-2026-100818)

Sandbox escape due to incorrect boundary conditions in the XPCOM component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.(CVE-2026-100819)

Privilege escalation in the Address Bar component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, and Firefox ESR 140.17.(CVE-2026-100820)

Site isolation issue in the Panning and Zooming component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.(CVE-2026-100821)

Use-after-free in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 140.17, Thunderbird 153.4, Firefox ESR 115.42, and Firefox ESR 140.17.(CVE-2026-100832)

Use-after-free in the Audio/Video: Web Codecs component. This vulnerability was fixed in Firefox 156, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.(CVE-2026-92005)

Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.(CVE-2026-92006)

Privilege escalation due to incorrect boundary conditions in the Graphics component. This vulnerability was fixed in Firefox ESR 115.41, Firefox ESR 140.16, and Thunderbird 140.16.(CVE-2026-92014)

Privilege escalation in the WebExtensions component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.(CVE-2026-92015)

Use-after-free in the Disability Access APIs component. This vulnerability was fixed in Firefox 156, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.(CVE-2026-92016)

Privilege escalation in the DOM: Service Workers component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.(CVE-2026-92017)

Sandbox escape in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.(CVE-2026-92018)

Mitigation bypass in the Remote Settings Client component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.(CVE-2026-92019)

Privilege escalation due to incorrect boundary conditions in the Graphics: WebRender component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.(CVE-2026-92020)

Use-after-free in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox ESR 140.16 and Thunderbird 140.16.(CVE-2026-92021)

Use-after-free in the DOM: HTML Parser component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.(CVE-2026-92022)

Use-after-free in the XML component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.(CVE-2026-92023)

Use-after-free in the SVG component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.(CVE-2026-92024)

Use-after-free in the DOM: Navigation component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.(CVE-2026-92025)

Use-after-free in the Networking component. This vulnerability was fixed in Firefox 156, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.(CVE-2026-92026)

Use-after-free in the DOM: Streams component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.(CVE-2026-92027)

Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.(CVE-2026-92028)

Mitigation bypass in the DOM: Copy & Paste and Drag & Drop component. This vulnerability was fixed in Firefox 156, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.(CVE-2026-92030)

Information disclosure in the Graphics: ImageLib component. This vulnerability was fixed in Firefox 156, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.(CVE-2026-92031)

Sandbox escape due to invalid pointer in the Graphics component. This vulnerability was fixed in Firefox 156, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.(CVE-2026-92032)

Sandbox escape due to incorrect boundary conditions in the Graphics component. This vulnerability was fixed in Thunderbird 140.17, Firefox 156, Firefox ESR 153.3, Thunderbird 156, Thunderbird 153.3, Firefox ESR 115.42, and Firefox ESR 140.17.(CVE-2026-92035)

A maliciously constructed mail header could lead to multiple fields being parsed as one, or potential memory safety violations. This vulnerability was fixed in Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.(CVE-2026-92238)

A maliciously constructed IMAP line could cause an out-of-bounds buffer read. This vulnerability was fixed in Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.(CVE-2026-92239)

A malicious or compromised IMAP server can trigger an out-of-bounds read in the IMAP response parser by sending an untagged '* ID' response, crashing Thunderbird. The affected parsing path is reachable before authentication. This vulnerability was fixed in Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.(CVE-2026-92240)

Information disclosure in the Networking component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, and Firefox ESR 140.17.(CVE-2026-96869)

Severity

9.8 (Critical)


                    
                      CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

URL

Type

	https://www.openeuler.org/zh/security/security-bu…	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2026-100756	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2026-100757	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2026-100758	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2026-100759	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2026-100762	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2026-100766	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2026-100767	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2026-100769	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2026-100770	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2026-100771	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2026-100772	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2026-100773	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2026-100774	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2026-100775	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2026-100776	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2026-100777	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2026-100778	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2026-100779	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2026-100780	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2026-100781	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2026-100782	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2026-100783	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2026-100784	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2026-100785	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2026-100786	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2026-100788	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2026-100789	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2026-100790	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2026-100791	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2026-100792	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2026-100794	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2026-100797	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2026-100801	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2026-100803	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2026-100807	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2026-100811	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2026-100818	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2026-100819	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2026-100820	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2026-100821	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2026-100832	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2026-92005	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2026-92006	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2026-92007	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2026-92008	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2026-92009	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2026-92010	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2026-92011	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2026-92012	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2026-92013	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2026-92014	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2026-92015	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2026-92016	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2026-92017	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2026-92018	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2026-92019	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2026-92020	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2026-92021	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2026-92022	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2026-92023	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2026-92024	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2026-92025	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2026-92026	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2026-92027	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2026-92028	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2026-92029	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2026-92030	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2026-92031	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2026-92032	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2026-92035	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2026-92238	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2026-92239	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2026-92240	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2026-96869	ADVISORY

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "aarch64": [
          "thunderbird-140.16.0-1.oe2403sp4.aarch64.rpm",
          "thunderbird-debuginfo-140.16.0-1.oe2403sp4.aarch64.rpm",
          "thunderbird-debugsource-140.16.0-1.oe2403sp4.aarch64.rpm",
          "thunderbird-librnp-rnp-140.16.0-1.oe2403sp4.aarch64.rpm",
          "thunderbird-wayland-140.16.0-1.oe2403sp4.aarch64.rpm"
        ],
        "src": [
          "thunderbird-140.16.0-1.oe2403sp4.src.rpm"
        ],
        "x86_64": [
          "thunderbird-140.16.0-1.oe2403sp4.x86_64.rpm",
          "thunderbird-debuginfo-140.16.0-1.oe2403sp4.x86_64.rpm",
          "thunderbird-debugsource-140.16.0-1.oe2403sp4.x86_64.rpm",
          "thunderbird-librnp-rnp-140.16.0-1.oe2403sp4.x86_64.rpm",
          "thunderbird-wayland-140.16.0-1.oe2403sp4.x86_64.rpm"
        ]
      },
      "package": {
        "ecosystem": "openEuler:24.03-LTS-SP4",
        "name": "thunderbird",
        "purl": "pkg:rpm/openEuler/thunderbird\u0026distro=openEuler-24.03-LTS-SP4"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "140.16.0-1.oe2403sp4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "database_specific": {
    "severity": "Critical"
  },
  "details": "Mozilla Thunderbird is a standalone mail and newsgroup client.\r\n\r\nSecurity Fix(es):\n\nIncorrect boundary conditions in the Audio/Video: Playback component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.(CVE-2026-100756)\n\nUse-after-free in the Widget component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.(CVE-2026-100757)\n\nSandbox escape in the DOM: Navigation component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.(CVE-2026-100758)\n\nUninitialized memory in the Storage: Quota Manager component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.(CVE-2026-100759)\n\nSandbox escape due to use-after-free in the DOM: Content Processes component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.(CVE-2026-100762)\n\nInformation disclosure in the Networking: JAR component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.(CVE-2026-100766)\n\nUse-after-free in the Networking: Cache component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.(CVE-2026-100767)\n\nUse-after-free in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, and Firefox ESR 140.17.(CVE-2026-100769)\n\nSandbox escape due to use-after-free in the DOM: Content Processes component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.(CVE-2026-100770)\n\nUndefined behavior in the DOM: Streams component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.(CVE-2026-100771)\n\nUse-after-free in the DOM: Core \u0026amp; HTML component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, and Firefox ESR 140.17.(CVE-2026-100772)\n\nUse-after-free in the Storage: IndexedDB component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.(CVE-2026-100773)\n\nUse-after-free in the DOM: Core \u0026amp; HTML component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.(CVE-2026-100774)\n\nSandbox escape in the Graphics component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.(CVE-2026-100775)\n\nUse-after-free in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, and Firefox ESR 140.17.(CVE-2026-100776)\n\nUse-after-free in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.(CVE-2026-100777)\n\nSandbox escape due to use-after-free in the DOM: Core \u0026amp; HTML component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.(CVE-2026-100778)\n\nUse-after-free in the XSLT component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.(CVE-2026-100779)\n\nUse-after-free in the DOM: Core \u0026amp; HTML component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.(CVE-2026-100780)\n\nSandbox escape due to incorrect boundary conditions in the Graphics: WebRender component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.(CVE-2026-100781)\n\nPrivilege escalation due to incorrect boundary conditions in the Graphics component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.(CVE-2026-100782)\n\nUninitialized memory in the Audio/Video component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.(CVE-2026-100783)\n\nUse-after-free in the Layout: Text and Fonts component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.(CVE-2026-100784)\n\nUse-after-free in the DOM: Core \u0026amp; HTML component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.(CVE-2026-100785)\n\nSandbox escape due to use-after-free in the Graphics component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.(CVE-2026-100786)\n\nInvalid pointer in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, and Firefox ESR 140.17.(CVE-2026-100788)\n\nUse-after-free in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.(CVE-2026-100789)\n\nUse-after-free in the XSLT component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.(CVE-2026-100790)\n\nUse-after-free in the DOM: Core \u0026amp; HTML component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.(CVE-2026-100791)\n\nJIT miscompilation in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, and Firefox ESR 140.17.(CVE-2026-100792)\n\nSandbox escape due to incorrect boundary conditions in the Internationalization component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, and Firefox ESR 140.17.(CVE-2026-100794)\n\nPrivilege escalation due to use-after-free in the Graphics: WebRender component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.(CVE-2026-100797)\n\nPrivilege escalation in the DLL Services component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, and Firefox ESR 140.17.(CVE-2026-100801)\n\nSame-origin policy bypass in the WebExtensions component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.(CVE-2026-100803)\n\nPrivilege escalation in the DOM: Service Workers component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, and Firefox ESR 140.17.(CVE-2026-100807)\n\nSandbox escape due to use-after-free in the DOM: Core \u0026amp; HTML component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, and Firefox ESR 140.17.(CVE-2026-100811)\n\nSandbox escape due to use-after-free in the Widget: Gtk component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, and Firefox ESR 140.17.(CVE-2026-100818)\n\nSandbox escape due to incorrect boundary conditions in the XPCOM component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.(CVE-2026-100819)\n\nPrivilege escalation in the Address Bar component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, and Firefox ESR 140.17.(CVE-2026-100820)\n\nSite isolation issue in the Panning and Zooming component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.(CVE-2026-100821)\n\nUse-after-free in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 140.17, Thunderbird 153.4, Firefox ESR 115.42, and Firefox ESR 140.17.(CVE-2026-100832)\n\nUse-after-free in the Audio/Video: Web Codecs component. This vulnerability was fixed in Firefox 156, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.(CVE-2026-92005)\n\nPrivilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.(CVE-2026-92006)\n\nPrivilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.(CVE-2026-92007)\n\nPrivilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.(CVE-2026-92008)\n\nPrivilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.(CVE-2026-92009)\n\nPrivilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.(CVE-2026-92010)\n\nPrivilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.(CVE-2026-92011)\n\nPrivilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.(CVE-2026-92012)\n\nPrivilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.(CVE-2026-92013)\n\nPrivilege escalation due to incorrect boundary conditions in the Graphics component. This vulnerability was fixed in Firefox ESR 115.41, Firefox ESR 140.16, and Thunderbird 140.16.(CVE-2026-92014)\n\nPrivilege escalation in the WebExtensions component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.(CVE-2026-92015)\n\nUse-after-free in the Disability Access APIs component. This vulnerability was fixed in Firefox 156, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.(CVE-2026-92016)\n\nPrivilege escalation in the DOM: Service Workers component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.(CVE-2026-92017)\n\nSandbox escape in the DOM: Core \u0026amp; HTML component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.(CVE-2026-92018)\n\nMitigation bypass in the Remote Settings Client component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.(CVE-2026-92019)\n\nPrivilege escalation due to incorrect boundary conditions in the Graphics: WebRender component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.(CVE-2026-92020)\n\nUse-after-free in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox ESR 140.16 and Thunderbird 140.16.(CVE-2026-92021)\n\nUse-after-free in the DOM: HTML Parser component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.(CVE-2026-92022)\n\nUse-after-free in the XML component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.(CVE-2026-92023)\n\nUse-after-free in the SVG component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.(CVE-2026-92024)\n\nUse-after-free in the DOM: Navigation component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.(CVE-2026-92025)\n\nUse-after-free in the Networking component. This vulnerability was fixed in Firefox 156, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.(CVE-2026-92026)\n\nUse-after-free in the DOM: Streams component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.(CVE-2026-92027)\n\nUse-after-free in the DOM: Core \u0026amp; HTML component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.(CVE-2026-92028)\n\nUse-after-free in the SVG component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.(CVE-2026-92029)\n\nMitigation bypass in the DOM: Copy \u0026amp; Paste and Drag \u0026amp; Drop component. This vulnerability was fixed in Firefox 156, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.(CVE-2026-92030)\n\nInformation disclosure in the Graphics: ImageLib component. This vulnerability was fixed in Firefox 156, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.(CVE-2026-92031)\n\nSandbox escape due to invalid pointer in the Graphics component. This vulnerability was fixed in Firefox 156, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.(CVE-2026-92032)\n\nSandbox escape due to incorrect boundary conditions in the Graphics component. This vulnerability was fixed in Thunderbird 140.17, Firefox 156, Firefox ESR 153.3, Thunderbird 156, Thunderbird 153.3, Firefox ESR 115.42, and Firefox ESR 140.17.(CVE-2026-92035)\n\nA maliciously constructed mail header could lead to multiple fields being parsed as one, or potential memory safety violations. This vulnerability was fixed in Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.(CVE-2026-92238)\n\nA maliciously constructed IMAP line could cause an out-of-bounds buffer read. This vulnerability was fixed in Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.(CVE-2026-92239)\n\nA malicious or compromised IMAP server can trigger an out-of-bounds read in the IMAP response parser by sending an untagged \u0026apos;* ID\u0026apos; response, crashing Thunderbird. The affected parsing path is reachable before authentication. This vulnerability was fixed in Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.(CVE-2026-92240)\n\nInformation disclosure in the Networking component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, and Firefox ESR 140.17.(CVE-2026-96869)",
  "id": "OESA-2026-4410",
  "modified": "2026-10-16T12:00:18Z",
  "published": "2026-10-16T12:00:18Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4410"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-100756"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-100757"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-100758"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-100759"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-100762"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-100766"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-100767"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-100769"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-100770"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-100771"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-100772"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-100773"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-100774"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-100775"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-100776"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-100777"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-100778"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-100779"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-100780"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-100781"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-100782"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-100783"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-100784"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-100785"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-100786"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-100788"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-100789"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-100790"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-100791"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-100792"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-100794"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-100797"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-100801"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-100803"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-100807"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-100811"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-100818"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-100819"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-100820"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-100821"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-100832"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-92005"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-92006"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-92007"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-92008"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-92009"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-92010"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-92011"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-92012"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-92013"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-92014"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-92015"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-92016"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-92017"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-92018"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-92019"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-92020"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-92021"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-92022"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-92023"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-92024"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-92025"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-92026"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-92027"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-92028"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-92029"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-92030"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-92031"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-92032"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-92035"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-92238"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-92239"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-92240"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-96869"
    }
  ],
  "schema_version": "1.7.2",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "thunderbird security update",
  "upstream": [
    "CVE-2026-100756",
    "CVE-2026-100757",
    "CVE-2026-100758",
    "CVE-2026-100759",
    "CVE-2026-100762",
    "CVE-2026-100766",
    "CVE-2026-100767",
    "CVE-2026-100769",
    "CVE-2026-100770",
    "CVE-2026-100771",
    "CVE-2026-100772",
    "CVE-2026-100773",
    "CVE-2026-100774",
    "CVE-2026-100775",
    "CVE-2026-100776",
    "CVE-2026-100777",
    "CVE-2026-100778",
    "CVE-2026-100779",
    "CVE-2026-100780",
    "CVE-2026-100781",
    "CVE-2026-100782",
    "CVE-2026-100783",
    "CVE-2026-100784",
    "CVE-2026-100785",
    "CVE-2026-100786",
    "CVE-2026-100788",
    "CVE-2026-100789",
    "CVE-2026-100790",
    "CVE-2026-100791",
    "CVE-2026-100792",
    "CVE-2026-100794",
    "CVE-2026-100797",
    "CVE-2026-100801",
    "CVE-2026-100803",
    "CVE-2026-100807",
    "CVE-2026-100811",
    "CVE-2026-100818",
    "CVE-2026-100819",
    "CVE-2026-100820",
    "CVE-2026-100821",
    "CVE-2026-100832",
    "CVE-2026-92005",
    "CVE-2026-92006",
    "CVE-2026-92007",
    "CVE-2026-92008",
    "CVE-2026-92009",
    "CVE-2026-92010",
    "CVE-2026-92011",
    "CVE-2026-92012",
    "CVE-2026-92013",
    "CVE-2026-92014",
    "CVE-2026-92015",
    "CVE-2026-92016",
    "CVE-2026-92017",
    "CVE-2026-92018",
    "CVE-2026-92019",
    "CVE-2026-92020",
    "CVE-2026-92021",
    "CVE-2026-92022",
    "CVE-2026-92023",
    "CVE-2026-92024",
    "CVE-2026-92025",
    "CVE-2026-92026",
    "CVE-2026-92027",
    "CVE-2026-92028",
    "CVE-2026-92029",
    "CVE-2026-92030",
    "CVE-2026-92031",
    "CVE-2026-92032",
    "CVE-2026-92035",
    "CVE-2026-92238",
    "CVE-2026-92239",
    "CVE-2026-92240",
    "CVE-2026-96869"
  ]
}

CVE-2026-100756 (GCVE-0-2026-100756)

Vulnerability from cvelistv5 – Published: 2026-09-29 12:35 – Updated: 2026-09-30 19:47

Title

Incorrect boundary conditions in the Audio/Video: Playback component

Summary

Severity

8.1 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-30 19:47 UTC

CWE

CWE-119 - Improper Restriction of Operations within the Bounds of a Memory Buffer

Assigner

mozilla CNA under the mitre root

CNA scorecard E 38/100 over 545 records in the last 180 days details

References

8 references

URL	Tags
https://bugzilla.mozilla.org/show_bug.cgi?id=2047721
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…

Impacted products

2 products

Vendor	Product	Version
Mozilla	Firefox	Unaffected: 115.42 , ≤ 115.* (rpm) Unaffected: 140.17 , ≤ 140.* (rpm) Unaffected: 153.4 , ≤ 153.* (rpm) Unaffected: 157 , ≤ * (rpm)
Mozilla	Thunderbird	Unaffected: 140.17 , ≤ 140.* (rpm) Unaffected: 153.4 , ≤ 153.* (rpm) Unaffected: 157 , ≤ * (rpm)

Credits

Mozilla

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 8.1,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-100756",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-30T19:47:01.045014Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-119",
                "description": "CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-30T19:47:05.596Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Firefox",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "115.*",
              "status": "unaffected",
              "version": "115.42",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "140.*",
              "status": "unaffected",
              "version": "140.17",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "153.*",
              "status": "unaffected",
              "version": "153.4",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "157",
              "versionType": "rpm"
            }
          ]
        },
        {
          "product": "Thunderbird",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "140.*",
              "status": "unaffected",
              "version": "140.17",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "153.*",
              "status": "unaffected",
              "version": "153.4",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "157",
              "versionType": "rpm"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Mozilla"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Incorrect boundary conditions in the Audio/Video: Playback component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17."
            }
          ],
          "value": "Incorrect boundary conditions in the Audio/Video: Playback component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-30T17:19:57.446Z",
        "orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
        "shortName": "mozilla"
      },
      "references": [
        {
          "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2047721"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-100/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-101/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-102/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-103/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-97/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-98/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-99/"
        }
      ],
      "title": "Incorrect boundary conditions in the Audio/Video: Playback component"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
    "assignerShortName": "mozilla",
    "cveId": "CVE-2026-100756",
    "datePublished": "2026-09-29T12:35:52.765Z",
    "dateReserved": "2026-09-26T19:15:13.788Z",
    "dateUpdated": "2026-09-30T19:47:05.596Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-100757 (GCVE-0-2026-100757)

Vulnerability from cvelistv5 – Published: 2026-09-29 12:35 – Updated: 2026-09-30 17:19

Title

Use-after-free in the Widget component

Summary

Severity

8.8 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-29 00:00 UTC

CWE

CWE-416 - Use After Free

Assigner

mozilla CNA under the mitre root

CNA scorecard E 38/100 over 545 records in the last 180 days details

References

8 references

URL	Tags
https://bugzilla.mozilla.org/show_bug.cgi?id=2049352
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…

Impacted products

2 products

Vendor	Product	Version
Mozilla	Firefox	Unaffected: 115.42 , ≤ 115.* (rpm) Unaffected: 140.17 , ≤ 140.* (rpm) Unaffected: 153.4 , ≤ 153.* (rpm) Unaffected: 157 , ≤ * (rpm)
Mozilla	Thunderbird	Unaffected: 140.17 , ≤ 140.* (rpm) Unaffected: 153.4 , ≤ 153.* (rpm) Unaffected: 157 , ≤ * (rpm)

Credits

Mohamed Mbarek

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 8.8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-100757",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-29T00:00:00+00:00",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-416",
                "description": "CWE-416 Use After Free",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-30T03:56:30.833Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Firefox",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "115.*",
              "status": "unaffected",
              "version": "115.42",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "140.*",
              "status": "unaffected",
              "version": "140.17",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "153.*",
              "status": "unaffected",
              "version": "153.4",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "157",
              "versionType": "rpm"
            }
          ]
        },
        {
          "product": "Thunderbird",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "140.*",
              "status": "unaffected",
              "version": "140.17",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "153.*",
              "status": "unaffected",
              "version": "153.4",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "157",
              "versionType": "rpm"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Mohamed Mbarek"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Use-after-free in the Widget component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17."
            }
          ],
          "value": "Use-after-free in the Widget component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-30T17:19:58.761Z",
        "orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
        "shortName": "mozilla"
      },
      "references": [
        {
          "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2049352"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-100/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-101/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-102/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-103/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-97/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-98/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-99/"
        }
      ],
      "title": "Use-after-free in the Widget component"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
    "assignerShortName": "mozilla",
    "cveId": "CVE-2026-100757",
    "datePublished": "2026-09-29T12:35:53.396Z",
    "dateReserved": "2026-09-26T19:15:14.718Z",
    "dateUpdated": "2026-09-30T17:19:58.761Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-100758 (GCVE-0-2026-100758)

Vulnerability from cvelistv5 – Published: 2026-09-29 12:35 – Updated: 2026-09-30 19:46

Title

Sandbox escape in the DOM: Navigation component

Summary

Severity

9.6 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-30 19:45 UTC

CWE

CWE-284 - Improper Access Control

Assigner

mozilla CNA under the mitre root

CNA scorecard E 38/100 over 545 records in the last 180 days details

References

8 references

URL	Tags
https://bugzilla.mozilla.org/show_bug.cgi?id=2049792
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…

Impacted products

2 products

Vendor	Product	Version
Mozilla	Firefox	Unaffected: 115.42 , ≤ 115.* (rpm) Unaffected: 140.17 , ≤ 140.* (rpm) Unaffected: 153.4 , ≤ 153.* (rpm) Unaffected: 157 , ≤ * (rpm)
Mozilla	Thunderbird	Unaffected: 140.17 , ≤ 140.* (rpm) Unaffected: 153.4 , ≤ 153.* (rpm) Unaffected: 157 , ≤ * (rpm)

Credits

Mozilla

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 9.6,
              "baseSeverity": "CRITICAL",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "CHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-100758",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-30T19:45:55.974454Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-284",
                "description": "CWE-284 Improper Access Control",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-30T19:46:01.024Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Firefox",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "115.*",
              "status": "unaffected",
              "version": "115.42",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "140.*",
              "status": "unaffected",
              "version": "140.17",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "153.*",
              "status": "unaffected",
              "version": "153.4",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "157",
              "versionType": "rpm"
            }
          ]
        },
        {
          "product": "Thunderbird",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "140.*",
              "status": "unaffected",
              "version": "140.17",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "153.*",
              "status": "unaffected",
              "version": "153.4",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "157",
              "versionType": "rpm"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Mozilla"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Sandbox escape in the DOM: Navigation component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17."
            }
          ],
          "value": "Sandbox escape in the DOM: Navigation component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-30T17:20:00.076Z",
        "orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
        "shortName": "mozilla"
      },
      "references": [
        {
          "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2049792"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-100/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-101/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-102/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-103/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-97/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-98/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-99/"
        }
      ],
      "title": "Sandbox escape in the DOM: Navigation component"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
    "assignerShortName": "mozilla",
    "cveId": "CVE-2026-100758",
    "datePublished": "2026-09-29T12:35:53.998Z",
    "dateReserved": "2026-09-26T19:15:15.623Z",
    "dateUpdated": "2026-09-30T19:46:01.024Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-100759 (GCVE-0-2026-100759)

Vulnerability from cvelistv5 – Published: 2026-09-29 12:35 – Updated: 2026-10-01 14:29

Title

Uninitialized memory in the Storage: Quota Manager component

Summary

Severity

8.1 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-01 14:29 UTC

CWE

CWE-457 - Use of Uninitialized Variable

Assigner

mozilla CNA under the mitre root

CNA scorecard E 38/100 over 545 records in the last 180 days details

References

8 references

URL	Tags
https://bugzilla.mozilla.org/show_bug.cgi?id=2054736
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…

Impacted products

2 products

Vendor	Product	Version
Mozilla	Firefox	Unaffected: 115.42 , ≤ 115.* (rpm) Unaffected: 140.17 , ≤ 140.* (rpm) Unaffected: 153.4 , ≤ 153.* (rpm) Unaffected: 157 , ≤ * (rpm)
Mozilla	Thunderbird	Unaffected: 140.17 , ≤ 140.* (rpm) Unaffected: 153.4 , ≤ 153.* (rpm) Unaffected: 157 , ≤ * (rpm)

Credits

Mozilla

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 8.1,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-100759",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-01T14:29:06.576097Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-457",
                "description": "CWE-457 Use of Uninitialized Variable",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-01T14:29:44.508Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Firefox",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "115.*",
              "status": "unaffected",
              "version": "115.42",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "140.*",
              "status": "unaffected",
              "version": "140.17",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "153.*",
              "status": "unaffected",
              "version": "153.4",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "157",
              "versionType": "rpm"
            }
          ]
        },
        {
          "product": "Thunderbird",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "140.*",
              "status": "unaffected",
              "version": "140.17",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "153.*",
              "status": "unaffected",
              "version": "153.4",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "157",
              "versionType": "rpm"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Mozilla"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Uninitialized memory in the Storage: Quota Manager component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17."
            }
          ],
          "value": "Uninitialized memory in the Storage: Quota Manager component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-30T17:20:01.360Z",
        "orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
        "shortName": "mozilla"
      },
      "references": [
        {
          "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2054736"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-100/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-101/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-102/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-103/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-97/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-98/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-99/"
        }
      ],
      "title": "Uninitialized memory in the Storage: Quota Manager component"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
    "assignerShortName": "mozilla",
    "cveId": "CVE-2026-100759",
    "datePublished": "2026-09-29T12:35:54.685Z",
    "dateReserved": "2026-09-26T19:15:16.495Z",
    "dateUpdated": "2026-10-01T14:29:44.508Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-100762 (GCVE-0-2026-100762)

Vulnerability from cvelistv5 – Published: 2026-09-29 12:35 – Updated: 2026-09-30 17:20

Title

Sandbox escape due to use-after-free in the DOM: Content Processes component

Summary

Severity

9.6 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-29 16:29 UTC

CWE

CWE-416 - Use After Free

Assigner

mozilla CNA under the mitre root

CNA scorecard E 38/100 over 545 records in the last 180 days details

References

8 references

URL	Tags
https://bugzilla.mozilla.org/show_bug.cgi?id=2059404
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…

Impacted products

2 products

Vendor	Product	Version
Mozilla	Firefox	Unaffected: 115.42 , ≤ 115.* (rpm) Unaffected: 140.17 , ≤ 140.* (rpm) Unaffected: 153.4 , ≤ 153.* (rpm) Unaffected: 157 , ≤ * (rpm)
Mozilla	Thunderbird	Unaffected: 140.17 , ≤ 140.* (rpm) Unaffected: 153.4 , ≤ 153.* (rpm) Unaffected: 157 , ≤ * (rpm)

Credits

Yaqoub Aldurayhim

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 9.6,
              "baseSeverity": "CRITICAL",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "CHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-100762",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-29T16:29:54.431429Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-416",
                "description": "CWE-416 Use After Free",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-29T16:40:06.477Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Firefox",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "115.*",
              "status": "unaffected",
              "version": "115.42",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "140.*",
              "status": "unaffected",
              "version": "140.17",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "153.*",
              "status": "unaffected",
              "version": "153.4",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "157",
              "versionType": "rpm"
            }
          ]
        },
        {
          "product": "Thunderbird",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "140.*",
              "status": "unaffected",
              "version": "140.17",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "153.*",
              "status": "unaffected",
              "version": "153.4",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "157",
              "versionType": "rpm"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Yaqoub Aldurayhim"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Sandbox escape due to use-after-free in the DOM: Content Processes component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17."
            }
          ],
          "value": "Sandbox escape due to use-after-free in the DOM: Content Processes component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-30T17:20:02.632Z",
        "orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
        "shortName": "mozilla"
      },
      "references": [
        {
          "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2059404"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-100/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-101/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-102/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-103/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-97/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-98/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-99/"
        }
      ],
      "title": "Sandbox escape due to use-after-free in the DOM: Content Processes component"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
    "assignerShortName": "mozilla",
    "cveId": "CVE-2026-100762",
    "datePublished": "2026-09-29T12:35:56.448Z",
    "dateReserved": "2026-09-26T19:15:19.245Z",
    "dateUpdated": "2026-09-30T17:20:02.632Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-100766 (GCVE-0-2026-100766)

Vulnerability from cvelistv5 – Published: 2026-09-29 12:35 – Updated: 2026-09-30 17:20

Title

Information disclosure in the Networking: JAR component

Summary

Severity

4.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-29 15:09 UTC

CWE

CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor

Assigner

mozilla CNA under the mitre root

CNA scorecard E 38/100 over 545 records in the last 180 days details

References

8 references

URL	Tags
https://bugzilla.mozilla.org/show_bug.cgi?id=2061526
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…

Impacted products

2 products

Vendor	Product	Version
Mozilla	Firefox	Unaffected: 115.42 , ≤ 115.* (rpm) Unaffected: 140.17 , ≤ 140.* (rpm) Unaffected: 153.4 , ≤ 153.* (rpm) Unaffected: 157 , ≤ * (rpm)
Mozilla	Thunderbird	Unaffected: 140.17 , ≤ 140.* (rpm) Unaffected: 153.4 , ≤ 153.* (rpm) Unaffected: 157 , ≤ * (rpm)

Credits

Mozilla

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 4.3,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "LOW",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-100766",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-29T15:09:26.697827Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-200",
                "description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-29T15:09:46.478Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Firefox",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "115.*",
              "status": "unaffected",
              "version": "115.42",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "140.*",
              "status": "unaffected",
              "version": "140.17",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "153.*",
              "status": "unaffected",
              "version": "153.4",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "157",
              "versionType": "rpm"
            }
          ]
        },
        {
          "product": "Thunderbird",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "140.*",
              "status": "unaffected",
              "version": "140.17",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "153.*",
              "status": "unaffected",
              "version": "153.4",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "157",
              "versionType": "rpm"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Mozilla"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Information disclosure in the Networking: JAR component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17."
            }
          ],
          "value": "Information disclosure in the Networking: JAR component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-30T17:20:03.915Z",
        "orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
        "shortName": "mozilla"
      },
      "references": [
        {
          "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2061526"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-100/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-101/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-102/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-103/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-97/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-98/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-99/"
        }
      ],
      "title": "Information disclosure in the Networking: JAR component"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
    "assignerShortName": "mozilla",
    "cveId": "CVE-2026-100766",
    "datePublished": "2026-09-29T12:35:58.608Z",
    "dateReserved": "2026-09-26T19:15:22.826Z",
    "dateUpdated": "2026-09-30T17:20:03.915Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-100767 (GCVE-0-2026-100767)

Vulnerability from cvelistv5 – Published: 2026-09-29 12:35 – Updated: 2026-09-30 17:20

Title

Use-after-free in the Networking: Cache component

Summary

Severity

8.8 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-29 00:00 UTC

CWE

CWE-416 - Use After Free

Assigner

mozilla CNA under the mitre root

CNA scorecard E 38/100 over 545 records in the last 180 days details

References

8 references

URL	Tags
https://bugzilla.mozilla.org/show_bug.cgi?id=2063680
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…

Impacted products

2 products

Vendor	Product	Version
Mozilla	Firefox	Unaffected: 115.42 , ≤ 115.* (rpm) Unaffected: 140.17 , ≤ 140.* (rpm) Unaffected: 153.4 , ≤ 153.* (rpm) Unaffected: 157 , ≤ * (rpm)
Mozilla	Thunderbird	Unaffected: 140.17 , ≤ 140.* (rpm) Unaffected: 153.4 , ≤ 153.* (rpm) Unaffected: 157 , ≤ * (rpm)

Credits

Mozilla

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 8.8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-100767",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-29T00:00:00+00:00",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-416",
                "description": "CWE-416 Use After Free",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-30T03:56:29.261Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Firefox",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "115.*",
              "status": "unaffected",
              "version": "115.42",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "140.*",
              "status": "unaffected",
              "version": "140.17",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "153.*",
              "status": "unaffected",
              "version": "153.4",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "157",
              "versionType": "rpm"
            }
          ]
        },
        {
          "product": "Thunderbird",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "140.*",
              "status": "unaffected",
              "version": "140.17",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "153.*",
              "status": "unaffected",
              "version": "153.4",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "157",
              "versionType": "rpm"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Mozilla"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Use-after-free in the Networking: Cache component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17."
            }
          ],
          "value": "Use-after-free in the Networking: Cache component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-30T17:20:05.205Z",
        "orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
        "shortName": "mozilla"
      },
      "references": [
        {
          "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2063680"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-100/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-101/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-102/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-103/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-97/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-98/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-99/"
        }
      ],
      "title": "Use-after-free in the Networking: Cache component"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
    "assignerShortName": "mozilla",
    "cveId": "CVE-2026-100767",
    "datePublished": "2026-09-29T12:35:59.246Z",
    "dateReserved": "2026-09-26T19:15:23.891Z",
    "dateUpdated": "2026-09-30T17:20:05.205Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-100769 (GCVE-0-2026-100769)

Vulnerability from cvelistv5 – Published: 2026-09-29 12:36 – Updated: 2026-09-30 17:20

Title

Use-after-free in the JavaScript: WebAssembly component

Summary

Severity

8.8 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-29 00:00 UTC

CWE

CWE-416 - Use After Free

Assigner

mozilla CNA under the mitre root

CNA scorecard E 38/100 over 545 records in the last 180 days details

References

7 references

URL	Tags
https://bugzilla.mozilla.org/show_bug.cgi?id=2067190
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…

Impacted products

2 products

Vendor	Product	Version
Mozilla	Thunderbird	Unaffected: 140.17 , ≤ 140.* (rpm) Unaffected: 153.4 , ≤ 153.* (rpm) Unaffected: 157 , ≤ * (rpm)
Mozilla	Firefox	Unaffected: 140.17 , ≤ 140.* (rpm) Unaffected: 153.4 , ≤ 153.* (rpm) Unaffected: 157 , ≤ * (rpm)

Credits

Tomer Fichman

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 8.8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-100769",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-29T00:00:00+00:00",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-416",
                "description": "CWE-416 Use After Free",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-30T03:56:27.864Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Thunderbird",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "140.*",
              "status": "unaffected",
              "version": "140.17",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "153.*",
              "status": "unaffected",
              "version": "153.4",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "157",
              "versionType": "rpm"
            }
          ]
        },
        {
          "product": "Firefox",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "140.*",
              "status": "unaffected",
              "version": "140.17",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "153.*",
              "status": "unaffected",
              "version": "153.4",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "157",
              "versionType": "rpm"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Tomer Fichman"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Use-after-free in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, and Firefox ESR 140.17."
            }
          ],
          "value": "Use-after-free in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, and Firefox ESR 140.17."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-30T17:20:06.465Z",
        "orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
        "shortName": "mozilla"
      },
      "references": [
        {
          "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2067190"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-100/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-101/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-102/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-103/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-97/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-99/"
        }
      ],
      "title": "Use-after-free in the JavaScript: WebAssembly component"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
    "assignerShortName": "mozilla",
    "cveId": "CVE-2026-100769",
    "datePublished": "2026-09-29T12:36:00.465Z",
    "dateReserved": "2026-09-26T19:15:25.691Z",
    "dateUpdated": "2026-09-30T17:20:06.465Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-100770 (GCVE-0-2026-100770)

Vulnerability from cvelistv5 – Published: 2026-09-29 12:36 – Updated: 2026-09-30 17:20

Title

Sandbox escape due to use-after-free in the DOM: Content Processes component

Summary

Severity

9.6 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-29 16:29 UTC

CWE

CWE-416 - Use After Free

Assigner

mozilla CNA under the mitre root

CNA scorecard E 38/100 over 545 records in the last 180 days details

References

8 references

URL	Tags
https://bugzilla.mozilla.org/show_bug.cgi?id=2068322
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…

Impacted products

2 products

Vendor	Product	Version
Mozilla	Firefox	Unaffected: 115.42 , ≤ 115.* (rpm) Unaffected: 140.17 , ≤ 140.* (rpm) Unaffected: 153.4 , ≤ 153.* (rpm) Unaffected: 157 , ≤ * (rpm)
Mozilla	Thunderbird	Unaffected: 140.17 , ≤ 140.* (rpm) Unaffected: 153.4 , ≤ 153.* (rpm) Unaffected: 157 , ≤ * (rpm)

Credits

Mozilla

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 9.6,
              "baseSeverity": "CRITICAL",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "CHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-100770",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-29T16:29:47.247930Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-416",
                "description": "CWE-416 Use After Free",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-29T16:40:06.326Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Firefox",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "115.*",
              "status": "unaffected",
              "version": "115.42",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "140.*",
              "status": "unaffected",
              "version": "140.17",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "153.*",
              "status": "unaffected",
              "version": "153.4",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "157",
              "versionType": "rpm"
            }
          ]
        },
        {
          "product": "Thunderbird",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "140.*",
              "status": "unaffected",
              "version": "140.17",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "153.*",
              "status": "unaffected",
              "version": "153.4",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "157",
              "versionType": "rpm"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Mozilla"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Sandbox escape due to use-after-free in the DOM: Content Processes component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17."
            }
          ],
          "value": "Sandbox escape due to use-after-free in the DOM: Content Processes component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-30T17:20:07.722Z",
        "orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
        "shortName": "mozilla"
      },
      "references": [
        {
          "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2068322"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-100/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-101/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-102/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-103/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-97/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-98/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-99/"
        }
      ],
      "title": "Sandbox escape due to use-after-free in the DOM: Content Processes component"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
    "assignerShortName": "mozilla",
    "cveId": "CVE-2026-100770",
    "datePublished": "2026-09-29T12:36:01.104Z",
    "dateReserved": "2026-09-26T19:15:26.594Z",
    "dateUpdated": "2026-09-30T17:20:07.722Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-100771 (GCVE-0-2026-100771)

Vulnerability from cvelistv5 – Published: 2026-09-29 12:36 – Updated: 2026-10-01 14:39

Title

Undefined behavior in the DOM: Streams component

Summary

Severity

8.1 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-01 14:39 UTC

CWE

CWE-758 - Reliance on Undefined, Unspecified, or Implementation-Defined Behavior

Assigner

mozilla CNA under the mitre root

CNA scorecard E 38/100 over 545 records in the last 180 days details

References

8 references

URL	Tags
https://bugzilla.mozilla.org/show_bug.cgi?id=2068336
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…

Impacted products

2 products

Vendor	Product	Version
Mozilla	Firefox	Unaffected: 115.42 , ≤ 115.* (rpm) Unaffected: 140.17 , ≤ 140.* (rpm) Unaffected: 153.4 , ≤ 153.* (rpm) Unaffected: 157 , ≤ * (rpm)
Mozilla	Thunderbird	Unaffected: 140.17 , ≤ 140.* (rpm) Unaffected: 153.4 , ≤ 153.* (rpm) Unaffected: 157 , ≤ * (rpm)

Credits

Mozilla

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 8.1,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-100771",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-01T14:39:29.258967Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-758",
                "description": "CWE-758 Reliance on Undefined, Unspecified, or Implementation-Defined Behavior",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-01T14:39:38.922Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Firefox",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "115.*",
              "status": "unaffected",
              "version": "115.42",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "140.*",
              "status": "unaffected",
              "version": "140.17",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "153.*",
              "status": "unaffected",
              "version": "153.4",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "157",
              "versionType": "rpm"
            }
          ]
        },
        {
          "product": "Thunderbird",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "140.*",
              "status": "unaffected",
              "version": "140.17",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "153.*",
              "status": "unaffected",
              "version": "153.4",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "157",
              "versionType": "rpm"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Mozilla"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Undefined behavior in the DOM: Streams component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17."
            }
          ],
          "value": "Undefined behavior in the DOM: Streams component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-30T17:20:09.027Z",
        "orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
        "shortName": "mozilla"
      },
      "references": [
        {
          "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2068336"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-100/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-101/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-102/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-103/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-97/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-98/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-99/"
        }
      ],
      "title": "Undefined behavior in the DOM: Streams component"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
    "assignerShortName": "mozilla",
    "cveId": "CVE-2026-100771",
    "datePublished": "2026-09-29T12:36:01.644Z",
    "dateReserved": "2026-09-26T19:15:27.479Z",
    "dateUpdated": "2026-10-01T14:39:38.922Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

OESA-2026-4410 (CVE-2026-100756)

CVE-2026-100756 (GCVE-0-2026-100756)

CVE-2026-100757 (GCVE-0-2026-100757)

CVE-2026-100758 (GCVE-0-2026-100758)

CVE-2026-100759 (GCVE-0-2026-100759)

CVE-2026-100762 (GCVE-0-2026-100762)

CVE-2026-100766 (GCVE-0-2026-100766)

CVE-2026-100767 (GCVE-0-2026-100767)

CVE-2026-100769 (GCVE-0-2026-100769)

CVE-2026-100770 (GCVE-0-2026-100770)

CVE-2026-100771 (GCVE-0-2026-100771)

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour