EUVD-2026-88910
GHSA-v6gg-9x3r-3gf2
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to malicious page
-
DeliveryDeliver crafted DOM navigation content
-
ExploitTrigger sandbox escape flaw
-
ExecutionBreak out of content process
-
ImpactExecute code on host
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires a Firefox user to load attacker-controlled web content (UI:R) - a malicious or compromised page, ad, or embedded frame - after which the sandbox escape in the DOM Navigation component allows the content process to break confinement (S:C). No authentication or special privileges are needed (PR:N), and default Firefox configurations are affected. The primary limiting factor is the required user interaction (the victim must visit the malicious content); the fix is present in Firefox 157, ESR 153.4, ESR 140.17, and ESR 115.42, so only pre-fix versions are exposed. |
| Impact | This is a genuine high-priority issue, not a high-CVSS-but-low-risk case. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H, 9.6 Critical) describes a browser sandbox escape: remotely reachable, low complexity, no privileges, requiring only that a victim visit attacker-controlled web content (UI:R), with a scope change (S:C) reflecting the compromised content process breaking out of its sandbox to affect the host. All three impact metrics are High, consistent with escaping renderer confinement toward host-level control. Mitigating the raw severity: exploitation is not passive - it needs user interaction (loading a malicious page), and Mozilla's advisory does not indicate active exploitation. No EPSS score was provided and there is no CISA KEV listing or public POC in the supplied data, so there is no evidence of widespread or active exploitation at this time - treat this as a serious latent risk driven by product ubiquity rather than confirmed in-the-wild abuse. One data caveat: the input Tags say 'Authentication Bypass,' which contradicts both the description (sandbox escape) and CWE-284 (Improper Access Control); the tag appears mislabeled and should not drive triage. |
| Exploit ScenarioDerived | An attacker hosts a malicious web page and lures a Firefox user to visit it (via link, ad, or compromised site). The page exploits the DOM Navigation flaw to break out of the content-process sandbox, gaining code execution with the browser's host-level privileges rather than being confined to the renderer. No public exploit code was identified at the time of analysis, and exploitation requires the victim to load the attacker's content. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 30, 2026
Sandbox escape in Mozilla Firefox's DOM Navigation component (CVE-2026-100758, CVSS 9.6) lets attacker-controlled web content escape the content-process sandbox and reach high-integrity resources on the host once a user loads a malicious or compromised page, ad, or embedded frame. The flaw requires no authentication or special privileges but does require the victim to visit the attacker's content (UI:R), and because the escape changes security scope (S:C) with high confidentiality, integrity, and availability impact, every pre-fix Firefox build - including the legacy ESR 115 branch - is exposed. No public exploit code or confirmed active exploitation was identified at time of analysis; Mozilla shipped fixes in Firefox 157, Firefox ESR 153.4, Firefox ESR 140.17, and Firefox ESR 115.42, so risk is concentrated in unpatched installs and in organizations that lag on ESR updates.
RemediationAI
Apply the vendor-released patch by upgrading to Firefox 157 on the rapid-release channel, Firefox ESR 153.4, Firefox ESR 140.17, or Firefox ESR 115.42 depending on which branch the endpoint tracks, and verify the running version via about:support or Help > About Firefox so that silent update failures are caught; advisory and release notes are at https://www.mozilla.org/security/advisories/mfsa2026-100/ and the tracking bug at https://bugzilla.mozilla.org/show_bug.cgi?id=2049792. Because the defect is an access-control error inside Firefox's own DOM Navigation logic, there is no configuration toggle that removes the exposure - disabling JavaScript or blocking iframe and navigation APIs would break normal browsing and is not a substitute for patching. For hosts that cannot be updated immediately, reduce exposure by restricting browsing to trusted sites or running Firefox inside an OS-level confinement boundary (a dedicated low-privilege user account, a container, or an application sandbox such as AppArmor/SELinux profiles or a browser isolation service), accepting the trade-offs of added friction and possible breakage of plugins and file-download workflows; alternatively, enforce upgrade deadlines through enterprise policy (policies.json/ExtensionSettings) and monitor for anomalous child-process behavior or repeated sandbox-related crashes as a rough indicator of exploitation attempts. The legacy ESR 115 branch is out of mainstream support, so affected systems still on 115.x should be migrated to a current ESR line rather than relying on the ESR 115.42 backport alone.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerable component is Firefox's DOM Navigation implementation, the code that handles window and browsing-context navigation (top-level and frame/iframe navigation) across Firefox's multi-process architecture. Modern Firefox runs web content in a low-privilege content process that is supposed to be confined by the sandbox; DOM navigation is one of the privileged boundary crossings between content and parent processes, so improper access control there can be abused to perform actions with the parent process's privileges. The assigned weakness, CWE-284 (Improper Access Control), describes exactly this class: a missing or incorrect privilege check on a navigation operation, rather than memory corruption, which is why the vendor's fix is a behavioral/authorization correction rather than a memory-safety patch. The CVSS vector AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H reflects remote delivery via web content, low attack complexity, no authentication requirement, mandatory user interaction (loading the page), and a scope change in which the attacker escalates from the content process into a higher-privileged context with full confidentiality, integrity, and availability impact. The CPE entry cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:* confirms that all Firefox release branches are in scope, and the vendor's own tagging of the issue as an authentication-bypass/sandbox-escape class issue is consistent with the access-control root cause. Mozilla's advisory set (mfsa2026-97 through mfsa2026-103 plus the tracking Bugzilla entry 2049792) shows the fix was backported across the rapid-release train and the ESR 153, ESR 140, and legacy ESR 115 channels simultaneously.
Know when Firefox gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Remote web content triggers the flaw with no privileges but requires the victim to load a page (UI:R); sandbox escape breaks confinement (S:C) yielding full host-level C/I/A impact.
Primary rating from Vendor (mozilla).
CVSS VectorVendor: mozilla
Lifecycle Timeline
3DescriptionCVE.org
Sandbox escape in the DOM: Navigation component. This vulnerability was fixed in Firefox ESR 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.
Executive ViewAI
Mozilla Firefox carries a critical sandbox-escape flaw that allows hostile or compromised web content to break out of the browser's isolated content process and reach high-integrity resources on the user's machine, meaning a single page visit could expose the underlying endpoint. Because Firefox is widely deployed across the workforce and the legacy ESR 115 branch is also affected, any employee running an unpatched build represents an endpoint compromise path that bypasses the protections leadership relies on to contain web-borne threats. The exposure is concentrated in unmanaged or slow-to-update installs, so the primary organizational risk is inconsistent patch coverage rather than a novel attack technique.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Affected Products (CPE)CVE.org
Mozilla Firefox before 18.0, Firefox ESR 10.x before 10.0.12 and 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderb
Use-after-free vulnerability in the serializeToStream implementation in the XMLSerializer component in Mozilla Firefox b
The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbi
The crypto.generateCRMFRequest function in Mozilla Firefox before 23.0, Firefox ESR 17.x before 17.0.8, Thunderbird befo
The XrayWrapper implementation in Mozilla Firefox before 35.0 and SeaMonkey before 2.32 does not properly interact with
The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 18.0, Firefox ESR 17.x before 17.0.2, Thunderbi
The Web IDL implementation in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and Se
Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and SeaMonkey before 2.25 allow remo
Integer underflow in the nsHtml5TreeBuilder class in the HTML5 string parser in Mozilla Firefox before 45.0 and Firefox
Mozilla Firefox before 37.0, Firefox ESR 31.x before 31.6, and Thunderbird before 31.6 do not properly restrict resource
Mozilla Firefox before 37.0 relies on docshell type information instead of page principal information for Window.webidl
The RC4 algorithm, as used in the TLS protocol and SSL protocol, has many single-byte biases, which makes it easier for
Exploit-DB