Skip to main content

Mozilla Firefox CVE-2026-100767

| EUVDEUVD-2026-88919 HIGH
Use After Free (CWE-416)
2026-09-29 mozilla GHSA-xvrr-g74x-xj9g
Information Disclosure Use After Free Memory Corruption Red Hat Mozilla Firefox
8.8
CVSS 3.1 · Vendor: mozilla
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Lure victim to malicious page
  2. Delivery
    Serve crafted cache-triggering content
  3. Exploit
    Trigger use-after-free in Networking:Cache
  4. Execution
    Reclaim freed object with controlled data
  5. Impact
    Execute code / leak memory in content process

Vulnerability Assessment

Weakness
CWE
CWE-416
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK

2 techniques across 2 tactics: Execution, Privilege Escalation

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Exploitation Conditions

Requires the victim to load attacker-controlled web content in a vulnerable Firefox build (versions prior to Firefox 157, ESR 153.4, ESR 140.17, or ESR 115.42) so the malicious page can drive the Networking:Cache component into the use-after-free state; UI:R means no exploitation without user navigation/interaction, and PR:N means no authentication is needed. No special server-side configuration is required, but exploitation is limited by user interaction, the need to reach the specific cache code path, and Firefox's content-process sandbox, which constrains a single UAF from immediately yielding full system compromise.
Impact

The CVSS 3.1 vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H = 8.8) describes a network-reachable, low-complexity, unauthenticated flaw that requires user interaction - the canonical browser drive-by profile: the victim must visit or render attacker-controlled web content. CWE-416 use-after-free in the Networking:Cache component is a classic memory-corruption primitive that Mozilla rates as HIGH-impact because such freed-memory reuse can escalate from an information leak to arbitrary code execution in the content process. No EPSS score, no CISA KEV entry, and no public exploit were provided in the input, so this is 'no public exploit identified at time of analysis' rather than confirmed exploitation - meaning the 8.8 reflects potential severity, not observed attacks. The realistic priority is nonetheless MEDIUM-to-HIGH because Firefox is ubiquitous and browser UAFs are historically prime targets for exploit-kit and targeted weaponization; the mitigating factor is that UI:R requires luring the victim and modern Firefox content sandboxing raises the bar for full escape. Patch is confirmed available across multiple release trains, which favors rapid remediation over emergency response absent any exploitation signal.
Exploit ScenarioDerived

An attacker hosts a malicious web page (or injects content via a compromised ad/iframe) that manipulates the browser's network cache to trigger the use-after-free when the victim navigates to it. Reuse of the freed cache object corrupts memory in the content process, enabling information disclosure or attacker-controlled code execution. No public proof-of-concept was identified in the provided data.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
No patch listed yet 0.3% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Sep 29, 2026

Mozilla Firefox builds prior to version 157, along with the ESR branches prior to 153.4, 140.17, and 115.42, contain a use-after-free in the Networking: Cache component that lets a remote attacker corrupt memory by persuading a victim to render attacker-controlled web content. The assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, 8.8) is the classic browser drive-by profile: no authentication is required, complexity is low, but exploitation depends on the user navigating to or loading a malicious page that reaches the specific cache code path, and the content-process sandbox limits how far a single use-after-free can be pushed toward full system compromise. The flaw is patched in Firefox 157 and Firefox ESR 153.4, ESR 140.17, and ESR 115.42; no CISA KEV listing and no public exploit code were identified at time of analysis, so this is a patch-now, high-severity memory-safety bug rather than a confirmed actively exploited one.

RemediationAI

Apply the vendor fix immediately: upgrade to Firefox 157, or to Firefox ESR 153.4, Firefox ESR 140.17, or Firefox ESR 115.42, whichever train your fleet tracks, and verify the installed version after deployment since ESR 115 installations in particular often lag far behind. Fixes and version details are published in Mozilla advisories https://www.mozilla.org/security/advisories/mfsa2026-100/, https://www.mozilla.org/security/advisories/mfsa2026-97/, https://www.mozilla.org/security/advisories/mfsa2026-98/, and https://www.mozilla.org/security/advisories/mfsa2026-99/, with technical background at https://bugzilla.mozilla.org/show_bug.cgi?id=2063680. Because exploitation requires the victim to load attacker-controlled web content, there is no meaningful server-side mitigation: blocking the vulnerable browser at the network edge or via application allow-listing is the only hard stop, at the cost of blocking all browsing for those users. Softer, unverified stopgaps for environments that cannot patch within the normal window include disabling the HTTP cache via enterprise policy (browser.cache.disk.enable and browser.cache.memory.enable set to false, alongside network.http.use-cache) to avoid the affected Networking: Cache code path, though this is not confirmed to block this specific UAF and will degrade page-load performance and increase network traffic; additionally, restricting users to trusted internal sites through policy reduces but does not eliminate exposure to injected or compromised content. After patching, keep the content-process sandbox, site isolation, and any exploit-mitigation hardening enabled, since the assessed impact assumes the sandbox absorbs the worst-case outcome of a single use-after-free.

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

The root cause is CWE-416 (Use-After-Free), a memory-safety class in which an object is freed while a stale pointer to it remains reachable, and subsequent use of that dangling reference reads or writes attacker-influenced memory. Here the affected subsystem is Firefox's Networking: Cache, the layer that stores, validates, and serves HTTP responses from memory and disk caches; because cache entries are shared between network requests and the content process, a dangling reference in this component can be turned into memory corruption (the record is also tagged Memory Corruption and Information Disclosure). The CPE cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:* confirms the target is Mozilla Firefox itself, with the fix set spanning the rapid-release channel (Firefox 157) and three ESR lines (153.x, 140.x, 115.x), which tells defenders that long-lived enterprise and legacy ESR deployments are the primary exposure. Exploitation requires the victim to load attacker-controlled content so the malicious page can drive the cache into the freed-then-reused state; the vector's UI:R reflects that required navigation, and PR:N confirms no credentials are needed. Mozilla's own advisory set (mfsa2026-97 through mfsa2026-100) and Bugzilla entry 2063680 document the fix, and the surrounding Firefox sandbox is what prevents an immediate jump from a single UAF to full system compromise.

Know when Firefox gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (mozilla) PRIMARY 8.8 HIGH
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
vuln.today AI 8.8 HIGH

Network-delivered malicious web content (AV:N/AC:L/PR:N) requires the victim to load a page (UI:R); a UAF grants high memory-corruption impact within the content process (C/I/A:H, S:U).

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE MEDIUM
Red Hat 7.5 HIGH

Primary rating from Vendor (mozilla).

CVSS VectorVendor: mozilla

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

3
CVSS changed
Sep 29, 2026 - 15:22 NVD
8.8 (HIGH)
CVE Published
Sep 29, 2026 - 12:35 cve.org
HIGH 8.8
CVE Published
Sep 29, 2026 - 12:35 cve.org
UNKNOWN (no severity yet)

DescriptionCVE.org

Use-after-free in the Networking: Cache component. This vulnerability was fixed in Firefox ESR 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.

Executive ViewAI

Why It Matters

Mozilla Firefox and its long-term-support (ESR) branches used across the organization are affected by a high-severity memory-corruption flaw in the browser's networking cache that a malicious or compromised website can trigger against any employee who simply visits it - no credentials, privileged access, or attacker foothold is required. Because Firefox is in everyday use for general browsing and third-party SaaS access, the potentially exposed population is effectively the entire workforce, and a successful exploit could lead to data disclosure or code execution within the browser's sandboxed content process. Mozilla has published fixed releases for every affected branch, so this is a contained patch-and-verify effort rather than an active incident; it should nonetheless be closed quickly while no public exploit code is circulating.

Business Impact: High
Compensating Controls

Apply vendor patch (Firefox 157; Firefox ESR 153.4, ESR 140.17, ESR 115.42). Where a host cannot be updated immediately, restrict browsing to an allow-listed set of sites, block uncategorized and newly registered domains, enforce script/content blockers, and run the browser in a restricted or disposable session; the built-in content-process sandbox already limits the reach of a single memory-corruption primitive and should remain enabled.

Threat Intelligence Overview

EPSS Score
0.3%
Top 75% exploitable
Prevalence
Ubiquitous
Firefox is one of the most widely deployed web browsers worldwide
Data Quality
7 sources
Confidence: High
EUVD 🇯🇵JVN NVD CVE.org EPSS Vulnrichment Vendor VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.3%
Patch available No
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision
Scheduled
Exploitation
None
System Exposure· derived
Open
Automatable
No
Human Impact
High
Technical Impact
Total

Priority Score

44
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +44
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Use After Free HIGH

Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.

Memory Corruption HIGH

Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.

Affected Products (CPE)CVE.org

cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*

More in Firefox

View all
CVE-2013-0758 CRITICAL POC
9.3 Jan 13

Mozilla Firefox before 18.0, Firefox ESR 10.x before 10.0.12 and 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderb
CVE-2013-0753 CRITICAL POC
9.3 Jan 13

Use-after-free vulnerability in the serializeToStream implementation in the XMLSerializer component in Mozilla Firefox b
CVE-2012-3993 CRITICAL POC
9.3 Oct 10

The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbi
CVE-2013-1710 CRITICAL POC
10.0 Aug 07

The crypto.generateCRMFRequest function in Mozilla Firefox before 23.0, Firefox ESR 17.x before 17.0.8, Thunderbird befo
CVE-2014-8636 HIGH POC
7.5 Jan 14

The XrayWrapper implementation in Mozilla Firefox before 35.0 and SeaMonkey before 2.32 does not properly interact with

CVE-2013-0757 CRITICAL POC
9.3 Jan 13

The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 18.0, Firefox ESR 17.x before 17.0.2, Thunderbi
CVE-2014-1510 CRITICAL POC
9.8 Mar 19

The Web IDL implementation in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and Se
CVE-2014-1511 CRITICAL POC
9.8 Mar 19

Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and SeaMonkey before 2.25 allow remo
CVE-2016-1960 HIGH POC
8.8 Mar 13

Integer underflow in the nsHtml5TreeBuilder class in the HTML5 string parser in Mozilla Firefox before 45.0 and Firefox

CVE-2015-0816 MEDIUM POC
5.0 Apr 01

Mozilla Firefox before 37.0, Firefox ESR 31.x before 31.6, and Thunderbird before 31.6 do not properly restrict resource
CVE-2015-0802 MEDIUM POC
5.0 Apr 01

Mozilla Firefox before 37.0 relies on docshell type information instead of page principal information for Window.webidl

CVE-2013-2566 MEDIUM POC
5.9 Mar 15

The RC4 algorithm, as used in the TLS protocol and SSL protocol, has many single-byte biases, which makes it easier for

Same weakness CWE-416 – Use After Free

View all
CVE-2019-0708 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2014-0322 HIGH POC
8.8
CVE-2012-4792 HIGH POC
8.8
CVE-2009-4324 HIGH POC
7.8
CVE-2015-0313 CRITICAL POC
9.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2013-2551 HIGH POC
8.8

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2025-68613 HIGH POC
8.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Module for Desktop Applications 15 SP7 Affected
SUSE Linux Enterprise Module for Package Hub 15 SP7 Affected
SUSE Linux Enterprise Server 15 SP7 Affected

References

Advisories & patches
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-100767 ADVISORY https://vuldb.com/vuln/411335 REF https://bugzilla.mozilla.org/show_bug.cgi?id=2063680 REF https://www.mozilla.org/security/advisories/mfsa2026-100/ REF https://www.mozilla.org/security/advisories/mfsa2026-101/ REF https://www.mozilla.org/security/advisories/mfsa2026-102/ REF https://www.mozilla.org/security/advisories/mfsa2026-103/ REF https://www.mozilla.org/security/advisories/mfsa2026-97/ REF https://www.mozilla.org/security/advisories/mfsa2026-98/ REF https://www.mozilla.org/security/advisories/mfsa2026-99/

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy