Vulnerability-Lookup

ALSA-2026:80674 (CVE-2026-100756)

Vulnerability from osv_almalinux – Published: 2026-10-12 00:00 – Updated: 2026-10-26 10:27 – Source website

Summary

Important: thunderbird security update

Details

Mozilla Thunderbird is a standalone mail and newsgroup client.

Security Fix(es):

firefox: thunderbird: Use-after-free in the Graphics: Canvas2D component (CVE-2026-100832)
firefox: Use-after-free in the Layout: Text and Fonts component (CVE-2026-100784)
firefox: thunderbird: Privilege escalation in the DLL Services component (CVE-2026-100801)
firefox: thunderbird: Sandbox escape due to incorrect boundary conditions in the Internationalization component (CVE-2026-100794)
firefox: thunderbird: Privilege escalation in the Address Bar component (CVE-2026-100820)
firefox: thunderbird: Use-after-free in the Graphics: Canvas2D component (CVE-2026-100777)
firefox: thunderbird: Information disclosure in the Networking: JAR component (CVE-2026-100766)
firefox: thunderbird: Use-after-free in the XSLT component (CVE-2026-100779)
firefox: thunderbird: Privilege escalation in the DOM: Service Workers component (CVE-2026-100807)
firefox: thunderbird: JIT miscompilation in the JavaScript: WebAssembly component (CVE-2026-100792)
firefox: Privilege escalation due to use-after-free in the Graphics: WebRender component (CVE-2026-100797)
firefox: thunderbird: Sandbox escape due to incorrect boundary conditions in the XPCOM component (CVE-2026-100819)
firefox: thunderbird: Use-after-free in the JavaScript: WebAssembly component (CVE-2026-100776)
firefox: thunderbird: Use-after-free in the Widget component (CVE-2026-100757)
firefox: Sandbox escape due to use-after-free in the Graphics component (CVE-2026-100786)
firefox: thunderbird: Information disclosure in the Networking component (CVE-2026-96869)
firefox: Sandbox escape due to use-after-free in the DOM: Content Processes component (CVE-2026-100770)
firefox: thunderbird: Use-after-free in the JavaScript: WebAssembly component (CVE-2026-100769)
firefox: Use-after-free in the DOM: Core & HTML component (CVE-2026-100791)
firefox: thunderbird: Sandbox escape due to use-after-free in the Widget: Gtk component (CVE-2026-100818)
firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics component (CVE-2026-100782)
firefox: firefox: Sandbox escape via use-after-free in DOM component (CVE-2026-100811)
firefox: thunderbird: Use-after-free in the DOM: Core & HTML component (CVE-2026-100772)
firefox: thunderbird: Uninitialized memory in the Storage: Quota Manager component (CVE-2026-100759)
firefox: Sandbox escape due to use-after-free in the DOM: Core & HTML component (CVE-2026-100778)
firefox: thunderbird: Sandbox escape in the DOM: Navigation component (CVE-2026-100758)
firefox: thunderbird: Sandbox escape in the Graphics component (CVE-2026-100775)
firefox: thunderbird: Sandbox escape due to incorrect boundary conditions in the Graphics: WebRender component (CVE-2026-100781)
firefox: Use-after-free in the DOM: Core & HTML component (CVE-2026-100774)
firefox: thunderbird: Same-origin policy bypass in the WebExtensions component (CVE-2026-100803)
firefox: thunderbird: Use-after-free in the Graphics: Canvas2D component (CVE-2026-100789)
firefox: thunderbird: Use-after-free in the DOM: Core & HTML component (CVE-2026-100785)
firefox: thunderbird: Site isolation issue in the Panning and Zooming component (CVE-2026-100821)
firefox: thunderbird: Invalid pointer in the JavaScript: WebAssembly component (CVE-2026-100788)
firefox: thunderbird: Undefined behavior in the DOM: Streams component (CVE-2026-100771)
firefox: Sandbox escape due to use-after-free in the DOM: Content Processes component (CVE-2026-100762)
firefox: thunderbird: Use-after-free in the XSLT component (CVE-2026-100790)
firefox: thunderbird: Use-after-free in the Storage: IndexedDB component (CVE-2026-100773)
firefox: thunderbird: Use-after-free in the DOM: Core & HTML component (CVE-2026-100780)
firefox: thunderbird: Use-after-free in the Networking: Cache component (CVE-2026-100767)
firefox: thunderbird: Incorrect boundary conditions in the Audio/Video: Playback component (CVE-2026-100756)
firefox: thunderbird: Uninitialized memory in the Audio/Video component (CVE-2026-100783)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

References

URL

Type

	https://access.redhat.com/errata/RHSA-2026:80674	ADVISORY
	https://access.redhat.com/security/cve/CVE-2026-100756	REPORT
	https://access.redhat.com/security/cve/CVE-2026-100757	REPORT
	https://access.redhat.com/security/cve/CVE-2026-100758	REPORT
	https://access.redhat.com/security/cve/CVE-2026-100759	REPORT
	https://access.redhat.com/security/cve/CVE-2026-100762	REPORT
	https://access.redhat.com/security/cve/CVE-2026-100766	REPORT
	https://access.redhat.com/security/cve/CVE-2026-100767	REPORT
	https://access.redhat.com/security/cve/CVE-2026-100769	REPORT
	https://access.redhat.com/security/cve/CVE-2026-100770	REPORT
	https://access.redhat.com/security/cve/CVE-2026-100771	REPORT
	https://access.redhat.com/security/cve/CVE-2026-100772	REPORT
	https://access.redhat.com/security/cve/CVE-2026-100773	REPORT
	https://access.redhat.com/security/cve/CVE-2026-100774	REPORT
	https://access.redhat.com/security/cve/CVE-2026-100775	REPORT
	https://access.redhat.com/security/cve/CVE-2026-100776	REPORT
	https://access.redhat.com/security/cve/CVE-2026-100777	REPORT
	https://access.redhat.com/security/cve/CVE-2026-100778	REPORT
	https://access.redhat.com/security/cve/CVE-2026-100779	REPORT
	https://access.redhat.com/security/cve/CVE-2026-100780	REPORT
	https://access.redhat.com/security/cve/CVE-2026-100781	REPORT
	https://access.redhat.com/security/cve/CVE-2026-100782	REPORT
	https://access.redhat.com/security/cve/CVE-2026-100783	REPORT
	https://access.redhat.com/security/cve/CVE-2026-100784	REPORT
	https://access.redhat.com/security/cve/CVE-2026-100785	REPORT
	https://access.redhat.com/security/cve/CVE-2026-100786	REPORT
	https://access.redhat.com/security/cve/CVE-2026-100788	REPORT
	https://access.redhat.com/security/cve/CVE-2026-100789	REPORT
	https://access.redhat.com/security/cve/CVE-2026-100790	REPORT
	https://access.redhat.com/security/cve/CVE-2026-100791	REPORT
	https://access.redhat.com/security/cve/CVE-2026-100792	REPORT
	https://access.redhat.com/security/cve/CVE-2026-100794	REPORT
	https://access.redhat.com/security/cve/CVE-2026-100797	REPORT
	https://access.redhat.com/security/cve/CVE-2026-100801	REPORT
	https://access.redhat.com/security/cve/CVE-2026-100803	REPORT
	https://access.redhat.com/security/cve/CVE-2026-100807	REPORT
	https://access.redhat.com/security/cve/CVE-2026-100811	REPORT
	https://access.redhat.com/security/cve/CVE-2026-100818	REPORT
	https://access.redhat.com/security/cve/CVE-2026-100819	REPORT
	https://access.redhat.com/security/cve/CVE-2026-100820	REPORT
	https://access.redhat.com/security/cve/CVE-2026-100821	REPORT
	https://access.redhat.com/security/cve/CVE-2026-100832	REPORT
	https://access.redhat.com/security/cve/CVE-2026-96869	REPORT
	https://bugzilla.redhat.com/2543114	REPORT
	https://bugzilla.redhat.com/2543133	REPORT
	https://bugzilla.redhat.com/2543142	REPORT
	https://bugzilla.redhat.com/2543145	REPORT
	https://bugzilla.redhat.com/2543149	REPORT
	https://bugzilla.redhat.com/2543150	REPORT
	https://bugzilla.redhat.com/2543154	REPORT
	https://bugzilla.redhat.com/2543157	REPORT
	https://bugzilla.redhat.com/2543163	REPORT
	https://bugzilla.redhat.com/2543166	REPORT
	https://bugzilla.redhat.com/2543182	REPORT
	https://errata.almalinux.org/10/ALSA-2026-80674.html	ADVISORY

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "thunderbird"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "140.17.0-1.el10_2.alma.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "details": "Mozilla Thunderbird is a standalone mail and newsgroup client.  \n\nSecurity Fix(es):  \n\n  * firefox: thunderbird: Use-after-free in the Graphics: Canvas2D component (CVE-2026-100832)\n  * firefox: Use-after-free in the Layout: Text and Fonts component (CVE-2026-100784)\n  * firefox: thunderbird: Privilege escalation in the DLL Services component (CVE-2026-100801)\n  * firefox: thunderbird: Sandbox escape due to incorrect boundary conditions in the Internationalization component (CVE-2026-100794)\n  * firefox: thunderbird: Privilege escalation in the Address Bar component (CVE-2026-100820)\n  * firefox: thunderbird: Use-after-free in the Graphics: Canvas2D component (CVE-2026-100777)\n  * firefox: thunderbird: Information disclosure in the Networking: JAR component (CVE-2026-100766)\n  * firefox: thunderbird: Use-after-free in the XSLT component (CVE-2026-100779)\n  * firefox: thunderbird: Privilege escalation in the DOM: Service Workers component (CVE-2026-100807)\n  * firefox: thunderbird: JIT miscompilation in the JavaScript: WebAssembly component (CVE-2026-100792)\n  * firefox: Privilege escalation due to use-after-free in the Graphics: WebRender component (CVE-2026-100797)\n  * firefox: thunderbird: Sandbox escape due to incorrect boundary conditions in the XPCOM component (CVE-2026-100819)\n  * firefox: thunderbird: Use-after-free in the JavaScript: WebAssembly component (CVE-2026-100776)\n  * firefox: thunderbird: Use-after-free in the Widget component (CVE-2026-100757)\n  * firefox: Sandbox escape due to use-after-free in the Graphics component (CVE-2026-100786)\n  * firefox: thunderbird: Information disclosure in the Networking component (CVE-2026-96869)\n  * firefox: Sandbox escape due to use-after-free in the DOM: Content Processes component (CVE-2026-100770)\n  * firefox: thunderbird: Use-after-free in the JavaScript: WebAssembly component (CVE-2026-100769)\n  * firefox: Use-after-free in the DOM: Core \u0026 HTML component (CVE-2026-100791)\n  * firefox: thunderbird: Sandbox escape due to use-after-free in the Widget: Gtk component (CVE-2026-100818)\n  * firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics component (CVE-2026-100782)\n  * firefox: firefox: Sandbox escape via use-after-free in DOM component (CVE-2026-100811)\n  * firefox: thunderbird: Use-after-free in the DOM: Core \u0026 HTML component (CVE-2026-100772)\n  * firefox: thunderbird: Uninitialized memory in the Storage: Quota Manager component (CVE-2026-100759)\n  * firefox: Sandbox escape due to use-after-free in the DOM: Core \u0026 HTML component (CVE-2026-100778)\n  * firefox: thunderbird: Sandbox escape in the DOM: Navigation component (CVE-2026-100758)\n  * firefox: thunderbird: Sandbox escape in the Graphics component (CVE-2026-100775)\n  * firefox: thunderbird: Sandbox escape due to incorrect boundary conditions in the Graphics: WebRender component (CVE-2026-100781)\n  * firefox: Use-after-free in the DOM: Core \u0026 HTML component (CVE-2026-100774)\n  * firefox: thunderbird: Same-origin policy bypass in the WebExtensions component (CVE-2026-100803)\n  * firefox: thunderbird: Use-after-free in the Graphics: Canvas2D component (CVE-2026-100789)\n  * firefox: thunderbird: Use-after-free in the DOM: Core \u0026 HTML component (CVE-2026-100785)\n  * firefox: thunderbird: Site isolation issue in the Panning and Zooming component (CVE-2026-100821)\n  * firefox: thunderbird: Invalid pointer in the JavaScript: WebAssembly component (CVE-2026-100788)\n  * firefox: thunderbird: Undefined behavior in the DOM: Streams component (CVE-2026-100771)\n  * firefox: Sandbox escape due to use-after-free in the DOM: Content Processes component (CVE-2026-100762)\n  * firefox: thunderbird: Use-after-free in the XSLT component (CVE-2026-100790)\n  * firefox: thunderbird: Use-after-free in the Storage: IndexedDB component (CVE-2026-100773)\n  * firefox: thunderbird: Use-after-free in the DOM: Core \u0026 HTML component (CVE-2026-100780)\n  * firefox: thunderbird: Use-after-free in the Networking: Cache component (CVE-2026-100767)\n  * firefox: thunderbird: Incorrect boundary conditions in the Audio/Video: Playback component (CVE-2026-100756)\n  * firefox: thunderbird: Uninitialized memory in the Audio/Video component (CVE-2026-100783)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n",
  "id": "ALSA-2026:80674",
  "modified": "2026-10-26T10:27:24Z",
  "published": "2026-10-12T00:00:00Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://access.redhat.com/errata/RHSA-2026:80674"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-100756"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-100757"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-100758"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-100759"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-100762"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-100766"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-100767"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-100769"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-100770"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-100771"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-100772"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-100773"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-100774"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-100775"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-100776"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-100777"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-100778"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-100779"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-100780"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-100781"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-100782"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-100783"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-100784"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-100785"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-100786"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-100788"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-100789"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-100790"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-100791"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-100792"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-100794"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-100797"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-100801"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-100803"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-100807"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-100811"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-100818"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-100819"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-100820"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-100821"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-100832"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-96869"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2543114"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2543133"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2543142"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2543145"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2543149"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2543150"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2543154"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2543157"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2543163"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2543166"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2543182"
    },
    {
      "type": "ADVISORY",
      "url": "https://errata.almalinux.org/10/ALSA-2026-80674.html"
    }
  ],
  "related": [
    "CVE-2026-100756",
    "CVE-2026-100757",
    "CVE-2026-100758",
    "CVE-2026-100759",
    "CVE-2026-100762",
    "CVE-2026-100766",
    "CVE-2026-100767",
    "CVE-2026-100769",
    "CVE-2026-100770",
    "CVE-2026-100771",
    "CVE-2026-100772",
    "CVE-2026-100773",
    "CVE-2026-100774",
    "CVE-2026-100775",
    "CVE-2026-100776",
    "CVE-2026-100777",
    "CVE-2026-100778",
    "CVE-2026-100779",
    "CVE-2026-100780",
    "CVE-2026-100781",
    "CVE-2026-100782",
    "CVE-2026-100783",
    "CVE-2026-100784",
    "CVE-2026-100785",
    "CVE-2026-100786",
    "CVE-2026-100788",
    "CVE-2026-100789",
    "CVE-2026-100790",
    "CVE-2026-100791",
    "CVE-2026-100792",
    "CVE-2026-100794",
    "CVE-2026-100797",
    "CVE-2026-100801",
    "CVE-2026-100803",
    "CVE-2026-100807",
    "CVE-2026-100811",
    "CVE-2026-100818",
    "CVE-2026-100819",
    "CVE-2026-100820",
    "CVE-2026-100821",
    "CVE-2026-100832",
    "CVE-2026-96869"
  ],
  "schema_version": "1.7.0",
  "summary": "Important: thunderbird security update",
  "upstream": [
    "CVE-2026-100756",
    "CVE-2026-100757",
    "CVE-2026-100758",
    "CVE-2026-100759",
    "CVE-2026-100762",
    "CVE-2026-100766",
    "CVE-2026-100767",
    "CVE-2026-100769",
    "CVE-2026-100770",
    "CVE-2026-100771",
    "CVE-2026-100772",
    "CVE-2026-100773",
    "CVE-2026-100774",
    "CVE-2026-100775",
    "CVE-2026-100776",
    "CVE-2026-100777",
    "CVE-2026-100778",
    "CVE-2026-100779",
    "CVE-2026-100780",
    "CVE-2026-100781",
    "CVE-2026-100782",
    "CVE-2026-100783",
    "CVE-2026-100784",
    "CVE-2026-100785",
    "CVE-2026-100786",
    "CVE-2026-100788",
    "CVE-2026-100789",
    "CVE-2026-100790",
    "CVE-2026-100791",
    "CVE-2026-100792",
    "CVE-2026-100794",
    "CVE-2026-100797",
    "CVE-2026-100801",
    "CVE-2026-100803",
    "CVE-2026-100807",
    "CVE-2026-100811",
    "CVE-2026-100818",
    "CVE-2026-100819",
    "CVE-2026-100820",
    "CVE-2026-100821",
    "CVE-2026-100832",
    "CVE-2026-96869"
  ]
}

CVE-2026-100756 (GCVE-0-2026-100756)

Vulnerability from cvelistv5 – Published: 2026-09-29 12:35 – Updated: 2026-09-30 19:47

Title

Incorrect boundary conditions in the Audio/Video: Playback component

Summary

Incorrect boundary conditions in the Audio/Video: Playback component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.

Severity

8.1 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-30 19:47 UTC

CWE

CWE-119 - Improper Restriction of Operations within the Bounds of a Memory Buffer

Assigner

mozilla CNA under the mitre root

CNA scorecard E 38/100 over 683 records in the last 180 days details

References

8 references

URL	Tags
https://bugzilla.mozilla.org/show_bug.cgi?id=2047721
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…

Impacted products

2 products

Vendor	Product	Version
Mozilla	Firefox	Unaffected: 115.42 , ≤ 115.* (rpm) Unaffected: 140.17 , ≤ 140.* (rpm) Unaffected: 153.4 , ≤ 153.* (rpm) Unaffected: 157 , ≤ * (rpm)
Mozilla	Thunderbird	Unaffected: 140.17 , ≤ 140.* (rpm) Unaffected: 153.4 , ≤ 153.* (rpm) Unaffected: 157 , ≤ * (rpm)

Credits

Mozilla

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 8.1,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-100756",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-30T19:47:01.045014Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-119",
                "description": "CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-30T19:47:05.596Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Firefox",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "115.*",
              "status": "unaffected",
              "version": "115.42",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "140.*",
              "status": "unaffected",
              "version": "140.17",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "153.*",
              "status": "unaffected",
              "version": "153.4",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "157",
              "versionType": "rpm"
            }
          ]
        },
        {
          "product": "Thunderbird",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "140.*",
              "status": "unaffected",
              "version": "140.17",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "153.*",
              "status": "unaffected",
              "version": "153.4",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "157",
              "versionType": "rpm"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Mozilla"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Incorrect boundary conditions in the Audio/Video: Playback component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17."
            }
          ],
          "value": "Incorrect boundary conditions in the Audio/Video: Playback component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-30T17:19:57.446Z",
        "orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
        "shortName": "mozilla"
      },
      "references": [
        {
          "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2047721"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-100/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-101/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-102/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-103/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-97/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-98/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-99/"
        }
      ],
      "title": "Incorrect boundary conditions in the Audio/Video: Playback component"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
    "assignerShortName": "mozilla",
    "cveId": "CVE-2026-100756",
    "datePublished": "2026-09-29T12:35:52.765Z",
    "dateReserved": "2026-09-26T19:15:13.788Z",
    "dateUpdated": "2026-09-30T19:47:05.596Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-100757 (GCVE-0-2026-100757)

Vulnerability from cvelistv5 – Published: 2026-09-29 12:35 – Updated: 2026-09-30 17:19

Title

Use-after-free in the Widget component

Summary

Use-after-free in the Widget component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.

Severity

8.8 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-29 00:00 UTC

CWE

CWE-416 - Use After Free

Assigner

mozilla CNA under the mitre root

CNA scorecard E 38/100 over 683 records in the last 180 days details

References

8 references

URL	Tags
https://bugzilla.mozilla.org/show_bug.cgi?id=2049352
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…

Impacted products

2 products

Vendor	Product	Version
Mozilla	Firefox	Unaffected: 115.42 , ≤ 115.* (rpm) Unaffected: 140.17 , ≤ 140.* (rpm) Unaffected: 153.4 , ≤ 153.* (rpm) Unaffected: 157 , ≤ * (rpm)
Mozilla	Thunderbird	Unaffected: 140.17 , ≤ 140.* (rpm) Unaffected: 153.4 , ≤ 153.* (rpm) Unaffected: 157 , ≤ * (rpm)

Credits

Mohamed Mbarek

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 8.8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-100757",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-29T00:00:00+00:00",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-416",
                "description": "CWE-416 Use After Free",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-30T03:56:30.833Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Firefox",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "115.*",
              "status": "unaffected",
              "version": "115.42",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "140.*",
              "status": "unaffected",
              "version": "140.17",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "153.*",
              "status": "unaffected",
              "version": "153.4",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "157",
              "versionType": "rpm"
            }
          ]
        },
        {
          "product": "Thunderbird",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "140.*",
              "status": "unaffected",
              "version": "140.17",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "153.*",
              "status": "unaffected",
              "version": "153.4",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "157",
              "versionType": "rpm"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Mohamed Mbarek"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Use-after-free in the Widget component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17."
            }
          ],
          "value": "Use-after-free in the Widget component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-30T17:19:58.761Z",
        "orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
        "shortName": "mozilla"
      },
      "references": [
        {
          "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2049352"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-100/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-101/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-102/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-103/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-97/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-98/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-99/"
        }
      ],
      "title": "Use-after-free in the Widget component"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
    "assignerShortName": "mozilla",
    "cveId": "CVE-2026-100757",
    "datePublished": "2026-09-29T12:35:53.396Z",
    "dateReserved": "2026-09-26T19:15:14.718Z",
    "dateUpdated": "2026-09-30T17:19:58.761Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-100758 (GCVE-0-2026-100758)

Vulnerability from cvelistv5 – Published: 2026-09-29 12:35 – Updated: 2026-09-30 19:46

Title

Sandbox escape in the DOM: Navigation component

Summary

Sandbox escape in the DOM: Navigation component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.

Severity

9.6 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-30 19:45 UTC

CWE

CWE-284 - Improper Access Control

Assigner

mozilla CNA under the mitre root

CNA scorecard E 38/100 over 683 records in the last 180 days details

References

8 references

URL	Tags
https://bugzilla.mozilla.org/show_bug.cgi?id=2049792
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…

Impacted products

2 products

Vendor	Product	Version
Mozilla	Firefox	Unaffected: 115.42 , ≤ 115.* (rpm) Unaffected: 140.17 , ≤ 140.* (rpm) Unaffected: 153.4 , ≤ 153.* (rpm) Unaffected: 157 , ≤ * (rpm)
Mozilla	Thunderbird	Unaffected: 140.17 , ≤ 140.* (rpm) Unaffected: 153.4 , ≤ 153.* (rpm) Unaffected: 157 , ≤ * (rpm)

Credits

Mozilla

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 9.6,
              "baseSeverity": "CRITICAL",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "CHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-100758",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-30T19:45:55.974454Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-284",
                "description": "CWE-284 Improper Access Control",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-30T19:46:01.024Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Firefox",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "115.*",
              "status": "unaffected",
              "version": "115.42",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "140.*",
              "status": "unaffected",
              "version": "140.17",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "153.*",
              "status": "unaffected",
              "version": "153.4",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "157",
              "versionType": "rpm"
            }
          ]
        },
        {
          "product": "Thunderbird",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "140.*",
              "status": "unaffected",
              "version": "140.17",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "153.*",
              "status": "unaffected",
              "version": "153.4",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "157",
              "versionType": "rpm"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Mozilla"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Sandbox escape in the DOM: Navigation component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17."
            }
          ],
          "value": "Sandbox escape in the DOM: Navigation component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-30T17:20:00.076Z",
        "orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
        "shortName": "mozilla"
      },
      "references": [
        {
          "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2049792"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-100/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-101/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-102/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-103/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-97/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-98/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-99/"
        }
      ],
      "title": "Sandbox escape in the DOM: Navigation component"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
    "assignerShortName": "mozilla",
    "cveId": "CVE-2026-100758",
    "datePublished": "2026-09-29T12:35:53.998Z",
    "dateReserved": "2026-09-26T19:15:15.623Z",
    "dateUpdated": "2026-09-30T19:46:01.024Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-100759 (GCVE-0-2026-100759)

Vulnerability from cvelistv5 – Published: 2026-09-29 12:35 – Updated: 2026-10-01 14:29

Title

Uninitialized memory in the Storage: Quota Manager component

Summary

Uninitialized memory in the Storage: Quota Manager component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.

Severity

8.1 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-01 14:29 UTC

CWE

CWE-457 - Use of Uninitialized Variable

Assigner

mozilla CNA under the mitre root

CNA scorecard E 38/100 over 683 records in the last 180 days details

References

8 references

URL	Tags
https://bugzilla.mozilla.org/show_bug.cgi?id=2054736
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…

Impacted products

2 products

Vendor	Product	Version
Mozilla	Firefox	Unaffected: 115.42 , ≤ 115.* (rpm) Unaffected: 140.17 , ≤ 140.* (rpm) Unaffected: 153.4 , ≤ 153.* (rpm) Unaffected: 157 , ≤ * (rpm)
Mozilla	Thunderbird	Unaffected: 140.17 , ≤ 140.* (rpm) Unaffected: 153.4 , ≤ 153.* (rpm) Unaffected: 157 , ≤ * (rpm)

Credits

Mozilla

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 8.1,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-100759",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-01T14:29:06.576097Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-457",
                "description": "CWE-457 Use of Uninitialized Variable",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-01T14:29:44.508Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Firefox",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "115.*",
              "status": "unaffected",
              "version": "115.42",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "140.*",
              "status": "unaffected",
              "version": "140.17",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "153.*",
              "status": "unaffected",
              "version": "153.4",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "157",
              "versionType": "rpm"
            }
          ]
        },
        {
          "product": "Thunderbird",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "140.*",
              "status": "unaffected",
              "version": "140.17",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "153.*",
              "status": "unaffected",
              "version": "153.4",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "157",
              "versionType": "rpm"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Mozilla"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Uninitialized memory in the Storage: Quota Manager component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17."
            }
          ],
          "value": "Uninitialized memory in the Storage: Quota Manager component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-30T17:20:01.360Z",
        "orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
        "shortName": "mozilla"
      },
      "references": [
        {
          "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2054736"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-100/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-101/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-102/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-103/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-97/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-98/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-99/"
        }
      ],
      "title": "Uninitialized memory in the Storage: Quota Manager component"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
    "assignerShortName": "mozilla",
    "cveId": "CVE-2026-100759",
    "datePublished": "2026-09-29T12:35:54.685Z",
    "dateReserved": "2026-09-26T19:15:16.495Z",
    "dateUpdated": "2026-10-01T14:29:44.508Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-100762 (GCVE-0-2026-100762)

Vulnerability from cvelistv5 – Published: 2026-09-29 12:35 – Updated: 2026-09-30 17:20

Title

Sandbox escape due to use-after-free in the DOM: Content Processes component

Summary

Sandbox escape due to use-after-free in the DOM: Content Processes component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.

Severity

9.6 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-29 16:29 UTC

CWE

CWE-416 - Use After Free

Assigner

mozilla CNA under the mitre root

CNA scorecard E 38/100 over 683 records in the last 180 days details

References

8 references

URL	Tags
https://bugzilla.mozilla.org/show_bug.cgi?id=2059404
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…

Impacted products

2 products

Vendor	Product	Version
Mozilla	Firefox	Unaffected: 115.42 , ≤ 115.* (rpm) Unaffected: 140.17 , ≤ 140.* (rpm) Unaffected: 153.4 , ≤ 153.* (rpm) Unaffected: 157 , ≤ * (rpm)
Mozilla	Thunderbird	Unaffected: 140.17 , ≤ 140.* (rpm) Unaffected: 153.4 , ≤ 153.* (rpm) Unaffected: 157 , ≤ * (rpm)

Credits

Yaqoub Aldurayhim

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 9.6,
              "baseSeverity": "CRITICAL",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "CHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-100762",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-29T16:29:54.431429Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-416",
                "description": "CWE-416 Use After Free",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-29T16:40:06.477Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Firefox",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "115.*",
              "status": "unaffected",
              "version": "115.42",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "140.*",
              "status": "unaffected",
              "version": "140.17",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "153.*",
              "status": "unaffected",
              "version": "153.4",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "157",
              "versionType": "rpm"
            }
          ]
        },
        {
          "product": "Thunderbird",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "140.*",
              "status": "unaffected",
              "version": "140.17",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "153.*",
              "status": "unaffected",
              "version": "153.4",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "157",
              "versionType": "rpm"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Yaqoub Aldurayhim"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Sandbox escape due to use-after-free in the DOM: Content Processes component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17."
            }
          ],
          "value": "Sandbox escape due to use-after-free in the DOM: Content Processes component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-30T17:20:02.632Z",
        "orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
        "shortName": "mozilla"
      },
      "references": [
        {
          "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2059404"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-100/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-101/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-102/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-103/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-97/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-98/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-99/"
        }
      ],
      "title": "Sandbox escape due to use-after-free in the DOM: Content Processes component"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
    "assignerShortName": "mozilla",
    "cveId": "CVE-2026-100762",
    "datePublished": "2026-09-29T12:35:56.448Z",
    "dateReserved": "2026-09-26T19:15:19.245Z",
    "dateUpdated": "2026-09-30T17:20:02.632Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-100766 (GCVE-0-2026-100766)

Vulnerability from cvelistv5 – Published: 2026-09-29 12:35 – Updated: 2026-09-30 17:20

Title

Information disclosure in the Networking: JAR component

Summary

Information disclosure in the Networking: JAR component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.

Severity

4.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-29 15:09 UTC

CWE

CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor

Assigner

mozilla CNA under the mitre root

CNA scorecard E 38/100 over 683 records in the last 180 days details

References

8 references

URL	Tags
https://bugzilla.mozilla.org/show_bug.cgi?id=2061526
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…

Impacted products

2 products

Vendor	Product	Version
Mozilla	Firefox	Unaffected: 115.42 , ≤ 115.* (rpm) Unaffected: 140.17 , ≤ 140.* (rpm) Unaffected: 153.4 , ≤ 153.* (rpm) Unaffected: 157 , ≤ * (rpm)
Mozilla	Thunderbird	Unaffected: 140.17 , ≤ 140.* (rpm) Unaffected: 153.4 , ≤ 153.* (rpm) Unaffected: 157 , ≤ * (rpm)

Credits

Mozilla

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 4.3,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "LOW",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-100766",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-29T15:09:26.697827Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-200",
                "description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-29T15:09:46.478Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Firefox",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "115.*",
              "status": "unaffected",
              "version": "115.42",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "140.*",
              "status": "unaffected",
              "version": "140.17",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "153.*",
              "status": "unaffected",
              "version": "153.4",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "157",
              "versionType": "rpm"
            }
          ]
        },
        {
          "product": "Thunderbird",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "140.*",
              "status": "unaffected",
              "version": "140.17",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "153.*",
              "status": "unaffected",
              "version": "153.4",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "157",
              "versionType": "rpm"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Mozilla"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Information disclosure in the Networking: JAR component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17."
            }
          ],
          "value": "Information disclosure in the Networking: JAR component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-30T17:20:03.915Z",
        "orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
        "shortName": "mozilla"
      },
      "references": [
        {
          "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2061526"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-100/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-101/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-102/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-103/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-97/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-98/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-99/"
        }
      ],
      "title": "Information disclosure in the Networking: JAR component"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
    "assignerShortName": "mozilla",
    "cveId": "CVE-2026-100766",
    "datePublished": "2026-09-29T12:35:58.608Z",
    "dateReserved": "2026-09-26T19:15:22.826Z",
    "dateUpdated": "2026-09-30T17:20:03.915Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-100767 (GCVE-0-2026-100767)

Vulnerability from cvelistv5 – Published: 2026-09-29 12:35 – Updated: 2026-09-30 17:20

Title

Use-after-free in the Networking: Cache component

Summary

Use-after-free in the Networking: Cache component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.

Severity

8.8 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-29 00:00 UTC

CWE

CWE-416 - Use After Free

Assigner

mozilla CNA under the mitre root

CNA scorecard E 38/100 over 683 records in the last 180 days details

References

8 references

URL	Tags
https://bugzilla.mozilla.org/show_bug.cgi?id=2063680
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…

Impacted products

2 products

Vendor	Product	Version
Mozilla	Firefox	Unaffected: 115.42 , ≤ 115.* (rpm) Unaffected: 140.17 , ≤ 140.* (rpm) Unaffected: 153.4 , ≤ 153.* (rpm) Unaffected: 157 , ≤ * (rpm)
Mozilla	Thunderbird	Unaffected: 140.17 , ≤ 140.* (rpm) Unaffected: 153.4 , ≤ 153.* (rpm) Unaffected: 157 , ≤ * (rpm)

Credits

Mozilla

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 8.8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-100767",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-29T00:00:00+00:00",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-416",
                "description": "CWE-416 Use After Free",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-30T03:56:29.261Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Firefox",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "115.*",
              "status": "unaffected",
              "version": "115.42",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "140.*",
              "status": "unaffected",
              "version": "140.17",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "153.*",
              "status": "unaffected",
              "version": "153.4",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "157",
              "versionType": "rpm"
            }
          ]
        },
        {
          "product": "Thunderbird",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "140.*",
              "status": "unaffected",
              "version": "140.17",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "153.*",
              "status": "unaffected",
              "version": "153.4",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "157",
              "versionType": "rpm"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Mozilla"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Use-after-free in the Networking: Cache component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17."
            }
          ],
          "value": "Use-after-free in the Networking: Cache component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-30T17:20:05.205Z",
        "orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
        "shortName": "mozilla"
      },
      "references": [
        {
          "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2063680"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-100/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-101/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-102/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-103/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-97/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-98/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-99/"
        }
      ],
      "title": "Use-after-free in the Networking: Cache component"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
    "assignerShortName": "mozilla",
    "cveId": "CVE-2026-100767",
    "datePublished": "2026-09-29T12:35:59.246Z",
    "dateReserved": "2026-09-26T19:15:23.891Z",
    "dateUpdated": "2026-09-30T17:20:05.205Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-100769 (GCVE-0-2026-100769)

Vulnerability from cvelistv5 – Published: 2026-09-29 12:36 – Updated: 2026-09-30 17:20

Title

Use-after-free in the JavaScript: WebAssembly component

Summary

Use-after-free in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, and Firefox ESR 140.17.

Severity

8.8 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-29 00:00 UTC

CWE

CWE-416 - Use After Free

Assigner

mozilla CNA under the mitre root

CNA scorecard E 38/100 over 683 records in the last 180 days details

References

7 references

URL	Tags
https://bugzilla.mozilla.org/show_bug.cgi?id=2067190
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…

Impacted products

2 products

Vendor	Product	Version
Mozilla	Thunderbird	Unaffected: 140.17 , ≤ 140.* (rpm) Unaffected: 153.4 , ≤ 153.* (rpm) Unaffected: 157 , ≤ * (rpm)
Mozilla	Firefox	Unaffected: 140.17 , ≤ 140.* (rpm) Unaffected: 153.4 , ≤ 153.* (rpm) Unaffected: 157 , ≤ * (rpm)

Credits

Tomer Fichman

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 8.8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-100769",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-29T00:00:00+00:00",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-416",
                "description": "CWE-416 Use After Free",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-30T03:56:27.864Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Thunderbird",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "140.*",
              "status": "unaffected",
              "version": "140.17",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "153.*",
              "status": "unaffected",
              "version": "153.4",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "157",
              "versionType": "rpm"
            }
          ]
        },
        {
          "product": "Firefox",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "140.*",
              "status": "unaffected",
              "version": "140.17",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "153.*",
              "status": "unaffected",
              "version": "153.4",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "157",
              "versionType": "rpm"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Tomer Fichman"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Use-after-free in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, and Firefox ESR 140.17."
            }
          ],
          "value": "Use-after-free in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, and Firefox ESR 140.17."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-30T17:20:06.465Z",
        "orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
        "shortName": "mozilla"
      },
      "references": [
        {
          "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2067190"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-100/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-101/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-102/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-103/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-97/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-99/"
        }
      ],
      "title": "Use-after-free in the JavaScript: WebAssembly component"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
    "assignerShortName": "mozilla",
    "cveId": "CVE-2026-100769",
    "datePublished": "2026-09-29T12:36:00.465Z",
    "dateReserved": "2026-09-26T19:15:25.691Z",
    "dateUpdated": "2026-09-30T17:20:06.465Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-100770 (GCVE-0-2026-100770)

Vulnerability from cvelistv5 – Published: 2026-09-29 12:36 – Updated: 2026-09-30 17:20

Title

Sandbox escape due to use-after-free in the DOM: Content Processes component

Summary

Severity

9.6 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-29 16:29 UTC

CWE

CWE-416 - Use After Free

Assigner

mozilla CNA under the mitre root

CNA scorecard E 38/100 over 683 records in the last 180 days details

References

8 references

URL	Tags
https://bugzilla.mozilla.org/show_bug.cgi?id=2068322
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…

Impacted products

2 products

Vendor	Product	Version
Mozilla	Firefox	Unaffected: 115.42 , ≤ 115.* (rpm) Unaffected: 140.17 , ≤ 140.* (rpm) Unaffected: 153.4 , ≤ 153.* (rpm) Unaffected: 157 , ≤ * (rpm)
Mozilla	Thunderbird	Unaffected: 140.17 , ≤ 140.* (rpm) Unaffected: 153.4 , ≤ 153.* (rpm) Unaffected: 157 , ≤ * (rpm)

Credits

Mozilla

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 9.6,
              "baseSeverity": "CRITICAL",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "CHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-100770",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-29T16:29:47.247930Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-416",
                "description": "CWE-416 Use After Free",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-29T16:40:06.326Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Firefox",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "115.*",
              "status": "unaffected",
              "version": "115.42",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "140.*",
              "status": "unaffected",
              "version": "140.17",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "153.*",
              "status": "unaffected",
              "version": "153.4",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "157",
              "versionType": "rpm"
            }
          ]
        },
        {
          "product": "Thunderbird",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "140.*",
              "status": "unaffected",
              "version": "140.17",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "153.*",
              "status": "unaffected",
              "version": "153.4",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "157",
              "versionType": "rpm"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Mozilla"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Sandbox escape due to use-after-free in the DOM: Content Processes component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17."
            }
          ],
          "value": "Sandbox escape due to use-after-free in the DOM: Content Processes component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-30T17:20:07.722Z",
        "orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
        "shortName": "mozilla"
      },
      "references": [
        {
          "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2068322"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-100/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-101/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-102/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-103/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-97/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-98/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-99/"
        }
      ],
      "title": "Sandbox escape due to use-after-free in the DOM: Content Processes component"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
    "assignerShortName": "mozilla",
    "cveId": "CVE-2026-100770",
    "datePublished": "2026-09-29T12:36:01.104Z",
    "dateReserved": "2026-09-26T19:15:26.594Z",
    "dateUpdated": "2026-09-30T17:20:07.722Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-100771 (GCVE-0-2026-100771)

Vulnerability from cvelistv5 – Published: 2026-09-29 12:36 – Updated: 2026-10-01 14:39

Title

Undefined behavior in the DOM: Streams component

Summary

Undefined behavior in the DOM: Streams component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.

Severity

8.1 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-01 14:39 UTC

CWE

CWE-758 - Reliance on Undefined, Unspecified, or Implementation-Defined Behavior

Assigner

mozilla CNA under the mitre root

CNA scorecard E 38/100 over 683 records in the last 180 days details

References

8 references

URL	Tags
https://bugzilla.mozilla.org/show_bug.cgi?id=2068336
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…

Impacted products

2 products

Vendor	Product	Version
Mozilla	Firefox	Unaffected: 115.42 , ≤ 115.* (rpm) Unaffected: 140.17 , ≤ 140.* (rpm) Unaffected: 153.4 , ≤ 153.* (rpm) Unaffected: 157 , ≤ * (rpm)
Mozilla	Thunderbird	Unaffected: 140.17 , ≤ 140.* (rpm) Unaffected: 153.4 , ≤ 153.* (rpm) Unaffected: 157 , ≤ * (rpm)

Credits

Mozilla

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 8.1,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-100771",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-01T14:39:29.258967Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-758",
                "description": "CWE-758 Reliance on Undefined, Unspecified, or Implementation-Defined Behavior",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-01T14:39:38.922Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Firefox",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "115.*",
              "status": "unaffected",
              "version": "115.42",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "140.*",
              "status": "unaffected",
              "version": "140.17",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "153.*",
              "status": "unaffected",
              "version": "153.4",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "157",
              "versionType": "rpm"
            }
          ]
        },
        {
          "product": "Thunderbird",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "140.*",
              "status": "unaffected",
              "version": "140.17",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "153.*",
              "status": "unaffected",
              "version": "153.4",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "157",
              "versionType": "rpm"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Mozilla"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Undefined behavior in the DOM: Streams component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17."
            }
          ],
          "value": "Undefined behavior in the DOM: Streams component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-30T17:20:09.027Z",
        "orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
        "shortName": "mozilla"
      },
      "references": [
        {
          "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2068336"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-100/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-101/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-102/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-103/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-97/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-98/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-99/"
        }
      ],
      "title": "Undefined behavior in the DOM: Streams component"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
    "assignerShortName": "mozilla",
    "cveId": "CVE-2026-100771",
    "datePublished": "2026-09-29T12:36:01.644Z",
    "dateReserved": "2026-09-26T19:15:27.479Z",
    "dateUpdated": "2026-10-01T14:39:38.922Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

How durations are calculated

Following the VTEM framework (Black Hat USA 2015), time to patch starts when the vendor or a coordinator was informed, total time to patch at discovery, and disclosure to patch at public disclosure; vendor response time runs from the report to its acknowledgement. Time to exploit and time unpatched start at the earliest discovery or report, falling back to public disclosure. Unpatched time ends at the first recorded patch, or the calculation time when no patch is recorded. Exploitation to patch shows the interval between those two events; a published proof of concept is a public exploit, not exploitation.

Each result shows its source dates. A negative interval means the end event came first; when date-only inputs leave the order open, the result says so. Date-only inputs are approximate. The earliest evidence wins: KEV report dates and sightings are labelled as such. Records describing another vulnerability are listed but never calculated from, and a PoC alone does not establish exploitation. Missing patch evidence does not prove that no patch exists. Filters below change the event list only.

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

ALSA-2026:80674 (CVE-2026-100756)

CVE-2026-100756 (GCVE-0-2026-100756)

CVE-2026-100757 (GCVE-0-2026-100757)

CVE-2026-100758 (GCVE-0-2026-100758)

CVE-2026-100759 (GCVE-0-2026-100759)

CVE-2026-100762 (GCVE-0-2026-100762)

CVE-2026-100766 (GCVE-0-2026-100766)

CVE-2026-100767 (GCVE-0-2026-100767)

CVE-2026-100769 (GCVE-0-2026-100769)

CVE-2026-100770 (GCVE-0-2026-100770)

CVE-2026-100771 (GCVE-0-2026-100771)

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour