What is the CVSS score of CVE-2026-100771?

CVE-2026-100771 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.2%.

How to fix or mitigate CVE-2026-100771?

Within 24 hours, inventory Firefox versions across managed endpoints and compare them against the version thresholds cited in the advisory (Firefox 157, Firefox ESR 153.4, Firefox ESR 140.17, Firefox ESR 115.42), confirm with Mozilla whether a fixed build has since shipped, and escalate deployment immediately if one has; in parallel, brief the SOC to watch for browser-process crashes and anomalous spawned processes on user workstations. Within 7 days, shrink exposure through browser policy: block or restrict uncategorized and newly registered domains at the proxy/DNS layer, keep site isolation and tracking-protection features enabled, and enforce least-privilege endpoint configuration so that a browser compromise cannot immediately escalate to administrative rights; deploy any interim Firefox release or ESR maintenance build Mozilla publishes as soon as it is available. Within 30 days, complete enterprise-wide rollout of the patched Firefox or ESR 153.x, 140.x, and 115.x updates, re-scan for unmanaged, portable, and third-party-bundled Firefox installations that sit outside the patch pipeline, and validate that detection coverage specifically targets memory-corruption exploitation in browser processes.

Mozilla Firefox CVE-2026-100771

EUVD-2026-88923 HIGH

Reliance on Undefined, Unspecified, or Implementation-Defined Behavior (CWE-758)

2026-09-29 mozilla

GHSA-27h8-27q2-7ppf

Information Disclosure Red Hat Mozilla Firefox

8.1

CVSS 3.1 · Vendor: mozilla

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Host malicious web page
Delivery

Lure victim to visit page (UI:R)
Exploit

Trigger undefined behavior in DOM Streams
Execution

Corrupt or read browser memory
Impact

Disclose sensitive data / alter state

Vulnerability Assessment

Weakness	CWE CWE-758 ASVS 5.0 V15 - Secure Coding and Architecture Reliance on undefined/unspecified behavior
Exploitation Conditions	Requires the victim to load attacker-controlled web content in an unpatched Firefox (UI:R) that exercises the DOM Streams API path triggering the undefined behavior; no authentication and no special browser configuration is needed (PR:N, default configuration). Limiting factors: exploitation is client-side and cannot proceed without user interaction (visiting a page or opening crafted content), and affected builds are those prior to Firefox 157, ESR 153.4, ESR 140.17, and ESR 115.42 - patched versions are not exploitable. As a CWE-758 memory-safety-class bug, reliable weaponization typically requires meaningful exploit-development effort, consistent with the very low EPSS.
Impact	Signals are mixed and point to moderate real-world priority rather than an urgent emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N, 8.1 High) describes a network-reachable, low-complexity, unauthenticated flaw requiring user interaction - i.e. a victim must visit attacker-controlled web content - with high confidentiality and integrity impact but no availability impact. Against that, EPSS is very low at 0.16% (4th percentile), there is no CISA KEV listing, and no public exploit was identified at time of analysis, so there is no public exploitation signal. CWE-758 (reliance on undefined behavior) in the DOM Streams component is a memory-safety-class issue typical of browser advisories; such bugs are often exploitable in principle but require nontrivial development to weaponize, which is consistent with the low EPSS. The 'Information Disclosure' tag understates the vector, which also carries I:H (integrity), so impact is not confidentiality-only. Net: a genuinely High-severity client-side browser flaw worth prompt patching given Firefox's footprint, but not a drop-everything issue absent any exploitation evidence.
Exploit ScenarioDerived	An attacker hosts a malicious web page that exercises the DOM Streams code path in a way that triggers undefined behavior in Firefox. A victim using an unpatched Firefox browser visits the page (UI:R), and the resulting memory-corruption/undefined-behavior condition is leveraged to disclose sensitive in-process data and/or corrupt browser state. No public proof-of-concept or active exploitation has been identified at time of analysis.

This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).

No patch listed yet 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Oct 01, 2026

Undefined behavior in the DOM Streams component of Mozilla Firefox allows remote, unauthenticated attackers to trigger memory-safety-class corruption in the browser process when a victim loads attacker-controlled web content, yielding high confidentiality and integrity impact (CVSS 3.1 base 8.1, AV:N/AC:L/PR:N/UI:R). The flaw affects builds prior to Firefox 157, Firefox ESR 153.4, Firefox ESR 140.17, and Firefox ESR 115.42, and requires user interaction - the victim must open a crafted page that exercises the vulnerable Streams API path - but no authentication or non-default browser configuration is needed. No public exploit code has been identified at time of analysis and CISA KEV does not list this issue; EPSS is very low at 0.16% (4th percentile), though the underlying CWE-758 memory-safety class means reliable weaponization would require substantial exploit-development effort rather than being trivially scriptable.

RemediationAI

Vendor-released patch: upgrade to Firefox 157 (mainline), Firefox ESR 153.4, Firefox ESR 140.17, or Firefox ESR 115.42 - whichever matches the installed branch - using the built-in updater or the packages from https://www.mozilla.org/security/advisories/ (mfsa2026-97 through mfsa2026-103). Verify completion by checking Help > About Firefox for the exact fixed version, and note that ESR 115.42 is the only remediation for hosts pinned to the legacy 115 branch, so environments that have frozen that branch must schedule the update rather than relying on 140.x/153.x installs elsewhere. Enterprise administrators should force an update check via the Mozilla Update policy or their software-deployment tooling and confirm that Firefox is not version-pinned by configuration. Where patching must be deferred, the practical trade-off is to restrict browsing to trusted origins and disable or block untrusted script execution with an extension such as NoScript or an enterprise content-filtering proxy, which reduces exposure to the crafted Streams-driven page but degrades general web usability and is not a reliable substitute for patching. Disabling JavaScript outright (about:config javascript.enabled=false) neutralizes the reachable attack surface but breaks the majority of modern sites; browser sandboxing, site isolation, and keeping the renderer sandbox enabled remain useful damage-limitation controls rather than fixes. Mozilla has not published a per-configuration workaround that blocks the vulnerable Streams path, and no public exploit code has been identified, so patching remains the primary and recommended action.

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

The vulnerability lives in Firefox's implementation of the DOM Streams API, the JavaScript-accessible abstraction (ReadableStream, WritableStream, TransformStream) used by the web platform for incremental data handling such as fetch response bodies and file reads. CWE-758 (Reliable Code of a Non-Standard or Undefined Behavior) indicates the root cause is a code path whose behavior is not well defined - typically an unhandled edge case in stream state transitions, queue/backpressure handling, or chunk transfer - which in a native browser engine can manifest as type confusion, use-after-free, or out-of-bounds access rather than a merely cosmetic glitch. Because Streams are reachable from ordinary page script, a website the victim visits can drive the component into the undefined state; the CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N) confirms the trigger is network-delivered, low complexity, requires no privileges, needs only the victim to load the content, and stays within the browser's security scope while compromising confidentiality and integrity (the Common Weakness Enumeration, CWE-758, and the Streams component attribution come from the CVE record; the CPE cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:* marks all unpatched Firefox builds as the affected product family).

Know when Firefox gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (mozilla) PRIMARY 8.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

vuln.today AI 8.1 HIGH

Web-delivered client-side flaw needing only a page visit: AV:N/AC:L/PR:N/UI:R; undefined behavior yields high confidentiality and integrity impact with no availability effect, in-process so S:U.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Red Hat 7.5 HIGH

Primary rating from Vendor (mozilla).

CVSS VectorVendor: mozilla

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

CVSS changed

Oct 01, 2026 - 15:22 NVD

8.1 (HIGH)

CVE Published

Sep 29, 2026 - 12:36 cve.org

UNKNOWN (no severity yet)

CVE Published

Sep 29, 2026 - 12:36 cve.org

HIGH 8.1

DescriptionCVE.org

Undefined behavior in the DOM: Streams component. This vulnerability was fixed in Firefox ESR 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.

Executive ViewAI

Why It Matters

A memory-safety flaw in Mozilla Firefox's DOM Streams component (CVE-2026-100771, CVSS 8.1) allows a crafted web page to corrupt the browser process, putting the confidentiality and integrity of anything a user does in that session at risk. Because Firefox is broadly deployed across the workforce and the trigger is simply loading hostile content - no credentials, elevated privileges, or non-default configuration required - any employee who browses the web is a potential entry point, and no vendor-released patch has been identified at the time of analysis. Leadership should treat this as an unpatched, high-severity browser exposure that demands interim mitigation and heightened detection rather than a routine update cycle.

Business Impact: High

Compensating Controls

No vendor-released patch identified at time of analysis. Interim mitigations: constrain browsing of untrusted or newly registered sites via network-layer filtering; keep site isolation, tracking protection, and sandboxing features enabled and avoid weakening them through policy; run browsers under standard-user (non-administrative) accounts to limit post-exploitation escalation; deploy crash and process-anomaly telemetry to detect browser memory-corruption attempts; and monitor Mozilla's advisory channel daily so a vendor fix is applied the moment it is published.

Threat Intelligence Overview

EPSS Score

0.2%

Top 96% exploitable

Prevalence

High

Firefox is a widely deployed major desktop browser across enterprises and consumers

Data Quality

6 sources

Confidence: High

EUVD 🇯🇵JVN

NVD

CVE.org

EPSS

Vulnrichment Vendor

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity HIGH

CISA KEV No

Public POC No

EPSS 0.2%

Patch available No

Active threat No

Deciding rule

HIGH severity (CVSS 7.0-8.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision

Scheduled

Exploitation

None

System Exposure· derived

Open

Automatable

Human Impact

High

Technical Impact

Total

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +40

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.