Skip to main content

Mozilla Firefox CVE-2026-100766

| EUVDEUVD-2026-88918 MEDIUM
Information Exposure (CWE-200)
2026-09-29 mozilla GHSA-pfpg-9xj2-7x85
Information Disclosure Red Hat Mozilla Firefox
4.3
CVSS 3.1 · Vendor: mozilla
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Host crafted JAR resource on page
  2. Exploit
    Victim visits malicious site
  3. Execution
    Trigger flaw in Networking:JAR handling
  4. Impact
    Leak limited sensitive information

Vulnerability Assessment

Weakness
CWE
CWE-200
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V14 - Data Protection Data exposure prevention
MITRE ATT&CK

2 techniques across 2 tactics: Collection, Discovery

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Exploitation Conditions

Requires user interaction (UI:R): the victim must load attacker-controlled web content that exercises the Networking: JAR component in an unpatched Firefox (prior to Firefox 157, ESR 153.4, ESR 140.17, or ESR 115.42). No authentication or elevated privileges are needed (PR:N), and it is remotely reachable, but exploitation is limited to disclosing a small amount of information (C:L) with no integrity or availability impact. The practical limiter is the need to entice a user to visit a crafted page and the low value/volume of the leaked data.
Impact

This is a low-severity client-side information-disclosure issue, not a priority for most defenders. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N, base 4.3) reflects a network-reachable but user-interaction-gated flaw with only limited confidentiality impact and no integrity or availability effect - consistent with the CWE-200 classification and the low base score. No EPSS score, CISA KEV entry, SSVC decision, or public POC was provided in the input, so all exploitation signals are absent. Per precision rules, exploitation status is 'no public exploit identified at time of analysis.' The absence of an SSVC/EPSS signal combined with Mozilla's own low 4.3 rating indicates this is genuinely a low-real-risk issue rather than a high-CVSS-but-overrated one; it is a defense-in-depth fix bundled with a larger Firefox security release. The only meaningful risk driver is the product's ubiquity - a low-impact bug shipped to an enormous browser install base - which argues for routine patching rather than emergency response.
Exploit ScenarioDerived

An attacker hosts a malicious web page that references crafted JAR-protocol / packaged resources, and lures a victim into visiting it with an unpatched Firefox. When the browser processes the JAR networking request, a small amount of otherwise-inaccessible information is leaked to the attacker's context. No public exploit code is identified at time of analysis.
This Month Plan within 30 days. Why: MEDIUM severity (CVSS 4.0-6.9).
No patch listed yet 0.3% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Sep 29, 2026

Information disclosure in Mozilla Firefox's Networking: JAR component allows remote, unauthenticated attackers to leak a limited amount of data when a victim loads attacker-controlled web content in an unpatched browser, with no integrity or availability impact. Affected builds are those prior to Firefox 157, Firefox ESR 153.4, Firefox ESR 140.17, and Firefox ESR 115.42; per the assessed vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N (base 4.3), the practical limiter is the required user interaction and the low value/volume of the exposed information. No public exploit code was identified at time of analysis, the issue is not listed in CISA KEV, and no EPSS score was supplied, so this is a low-severity client-side disclosure rather than an active-threat priority.

RemediationAI

Vendor-released patch: upgrade to Firefox 157 on the main channel, or to Firefox ESR 153.4, Firefox ESR 140.17, or Firefox ESR 115.42 on the corresponding ESR branches - these are the exact fixed versions named in the CVE record and the Mozilla advisories (https://www.mozilla.org/security/advisories/mfsa2026-100/ for the main release, with ESR coverage in https://www.mozilla.org/security/advisories/mfsa2026-97/, https://www.mozilla.org/security/advisories/mfsa2026-98/, and https://www.mozilla.org/security/advisories/mfsa2026-99/, and the code change tracked at https://bugzilla.mozilla.org/show_bug.cgi?id=2061526). Because the fix touches the shared Networking: JAR code path, Firefox ESR users should be moved quickly to 153.4 or 140.17; organisations still pinned to the 115 ESR line can apply 115.42, but given that branch is far behind current ESR releases they should treat that update as a bridge and schedule migration, since the trade-off is continued exposure to future unpatched issues on an aging branch. Neither the CVE record nor the referenced advisories publish a standalone configuration workaround such as disabling the jar: protocol handler, so there is no vendor-endorsed interim toggle to rely on; the practical compensating measures are to enforce the update through enterprise policy or managed deployment, restrict browsing of untrusted content where policy allows, and treat the residual risk as low because exploitation requires the user to load crafted content and yields only a small confidentiality leak with no integrity or availability effect. No firewall or port-blocking mitigation is applicable, as the weakness is exercised inside the browser's URI handling of content the user already chose to open.

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

The vulnerability sits in Firefox's Networking: JAR component - the code that implements the jar: URI scheme, which lets the browser treat a compressed archive as a browsable container by referencing an inner resource (for example jar:<archive-url>!/<path>). Historically this handler has been a recurring source of origin-confusion and resource-resolution bugs because a JAR wrapper creates a synthesized origin layered on top of the underlying archive location. The assigned CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) indicates the root cause is improper exposure of data to a party that should not receive it, rather than memory corruption, injection, or privilege escalation. The patch landed simultaneously across Firefox release and three Extended Support Release branches (main, plus the 153.x, 140.x, and 115.x ESR lines), which is typical Mozilla practice for a defect that affects code shared across all maintained channels; the fixing changes are tracked in Mozilla bug 2061526 and documented in advisories mfsa2026-100, mfsa2026-97, mfsa2026-98, and mfsa2026-99. The CPE entry cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:* is a wildcard and therefore does not constrain the affected range on its own - the version boundaries must be taken from the advisory text. Because exploitation surfaces only through content the user chooses to load and the resulting leak is small (C:L, confidentiality only), the component-level exposure is narrow compared with the memory-safety classes Firefox typically patches.

Know when Firefox gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (mozilla) PRIMARY 4.3 MEDIUM
AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
vuln.today AI 4.3 MEDIUM

Network-reachable via crafted page (AV:N) but requires the victim to visit it (UI:R); no auth (PR:N); limited info leak only (C:L, I/A:N), matching Mozilla's 4.3.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
SUSE MEDIUM
Red Hat 7.5 HIGH

Primary rating from Vendor (mozilla).

CVSS VectorVendor: mozilla

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
Low
Integrity
None
Availability
None

Lifecycle Timeline

2
CVE Published
Sep 29, 2026 - 12:35 cve.org
MEDIUM 4.3
CVE Published
Sep 29, 2026 - 12:35 cve.org
UNKNOWN (no severity yet)

DescriptionCVE.org

Information disclosure in the Networking: JAR component. This vulnerability was fixed in Firefox ESR 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.

Threat Intelligence Overview

EPSS Score
0.3%
Top 83% exploitable
Prevalence
Ubiquitous
Firefox is one of the most widely deployed desktop web browsers worldwide
Data Quality
7 sources
Confidence: High
EUVD 🇯🇵JVN NVD CVE.org EPSS Vulnrichment Vendor VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity MEDIUM
CISA KEV No
Public POC No
EPSS 0.3%
Patch available No
Active threat No
Deciding rule
MEDIUM severity (CVSS 4.0-6.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Scheduled
Exploitation
None
System Exposure· derived
Open
Automatable
No
Human Impact· derived
High
Technical Impact
Partial

Priority Score

22
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +22
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.

Affected Products (CPE)CVE.org

cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*

More in Firefox

View all
CVE-2013-0758 CRITICAL POC
9.3 Jan 13

Mozilla Firefox before 18.0, Firefox ESR 10.x before 10.0.12 and 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderb
CVE-2013-0753 CRITICAL POC
9.3 Jan 13

Use-after-free vulnerability in the serializeToStream implementation in the XMLSerializer component in Mozilla Firefox b
CVE-2012-3993 CRITICAL POC
9.3 Oct 10

The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbi
CVE-2013-1710 CRITICAL POC
10.0 Aug 07

The crypto.generateCRMFRequest function in Mozilla Firefox before 23.0, Firefox ESR 17.x before 17.0.8, Thunderbird befo
CVE-2014-8636 HIGH POC
7.5 Jan 14

The XrayWrapper implementation in Mozilla Firefox before 35.0 and SeaMonkey before 2.32 does not properly interact with

CVE-2013-0757 CRITICAL POC
9.3 Jan 13

The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 18.0, Firefox ESR 17.x before 17.0.2, Thunderbi
CVE-2014-1510 CRITICAL POC
9.8 Mar 19

The Web IDL implementation in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and Se
CVE-2014-1511 CRITICAL POC
9.8 Mar 19

Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and SeaMonkey before 2.25 allow remo
CVE-2016-1960 HIGH POC
8.8 Mar 13

Integer underflow in the nsHtml5TreeBuilder class in the HTML5 string parser in Mozilla Firefox before 45.0 and Firefox

CVE-2015-0816 MEDIUM POC
5.0 Apr 01

Mozilla Firefox before 37.0, Firefox ESR 31.x before 31.6, and Thunderbird before 31.6 do not properly restrict resource
CVE-2015-0802 MEDIUM POC
5.0 Apr 01

Mozilla Firefox before 37.0 relies on docshell type information instead of page principal information for Window.webidl

CVE-2013-2566 MEDIUM POC
5.9 Mar 15

The RC4 algorithm, as used in the TLS protocol and SSL protocol, has many single-byte biases, which makes it easier for

Same weakness CWE-200 – Information Exposure

View all
CVE-2024-24919 HIGH POC
8.6
CVE-2021-41277 HIGH POC
7.5
CVE-2016-6415 HIGH POC
7.5
CVE-2013-7331 MEDIUM POC
6.5
CVE-2025-31125 MEDIUM POC
5.3
CVE-2025-11749 CRITICAL POC
9.8
CVE-2017-16894 HIGH POC
7.5
CVE-2017-11165 CRITICAL POC
9.8

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2025-68613 HIGH POC
8.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Module for Desktop Applications 15 SP7 Affected
SUSE Linux Enterprise Module for Package Hub 15 SP7 Affected
SUSE Linux Enterprise Server 15 SP7 Affected

References

Advisories & patches
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-100766 ADVISORY https://vuldb.com/vuln/411325 REF https://bugzilla.mozilla.org/show_bug.cgi?id=2061526 REF https://www.mozilla.org/security/advisories/mfsa2026-100/ REF https://www.mozilla.org/security/advisories/mfsa2026-101/ REF https://www.mozilla.org/security/advisories/mfsa2026-102/ REF https://www.mozilla.org/security/advisories/mfsa2026-103/ REF https://www.mozilla.org/security/advisories/mfsa2026-97/ REF https://www.mozilla.org/security/advisories/mfsa2026-98/ REF https://www.mozilla.org/security/advisories/mfsa2026-99/

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy