What is the CVSS score of CVE-2026-100775?

CVE-2026-100775 has a CVSS 3.1 base score of 9.6 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

How to fix or mitigate CVE-2026-100775?

Within 24 hours, inventory Firefox and Firefox ESR installs across the estate and confirm which endpoints are below Firefox 157 or below the ESR trains 153.4, 140.17, and 115.42; note that vendor-fixed builds for each release train are identified in the advisory, while the accompanying vulnerability feed lists patch status as not available, so validate the fixed versions against Mozilla's official advisory before closing any remediation ticket. Within 7 days, deploy the vendor-released updates to all affected endpoints - Firefox 157 for the rapid release train and ESR 153.4, 140.17, or 115.42 for extended-support users - prioritizing browsers used for internet-facing or high-risk web activity, and confirm successful installs through endpoint management reporting rather than relying on user self-reporting. Within 30 days, verify through a re-scan that no endpoint remains on an affected build, fold Firefox version compliance into routine patch SLAs and software inventory baselines, and retain the exposure-reduction guidance in user awareness messaging about avoiding untrusted links and downloads, since exploitation requires a victim to render attacker-controlled web content and to additionally compromise the content process.

Mozilla Firefox CVE-2026-100775

EUVD-2026-88927 CRITICAL

Protection Mechanism Failure (CWE-693)

2026-09-29 mozilla

GHSA-mw76-22g7-fw96

Information Disclosure Red Hat Mozilla Firefox

9.6

CVSS 3.1 · Vendor: mozilla

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Lure victim to malicious web page
Delivery

Serve crafted graphics content
Exploit

Trigger flaw in Graphics component
Execution

Defeat content-process sandbox
Impact

Execute code on host system

Vulnerability Assessment

Weakness	CWE CWE-693 OWASP Top 10:2025 A06:2025 - Insecure Design ASVS 5.0 V15 - Secure Coding and Architecture Protection mechanism completeness
Exploitation Conditions	Requires the victim to visit or render attacker-controlled web content in Firefox (UI:R), with no authentication or privileges needed (PR:N). The affected vector is the Graphics component in affected Firefox/Firefox ESR builds prior to 157/ESR 153.4/140.17/115.42 in their default configuration. The principal limiting factor is that a sandbox escape alone does not yield code execution - it must be combined with a separate content-process compromise to break out of the sandbox, consistent with CISA's 'Automatable: no' rating; this chaining requirement, plus the mandatory user interaction, meaningfully constrains real-world exploitation despite the critical score.
Impact	Signals conflict sharply here, so prioritization should be nuanced. The CVSS 3.1 score of 9.6 (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H) is critical, driven by the scope change (S:C) inherent to a sandbox escape and full C/I/A impact, requiring only user interaction and no privileges. However, nearly every other signal points lower: EPSS is just 0.16% (4th percentile), CISA SSVC rates Exploitation as 'none' and Automatable as 'no' (with Technical Impact 'total'), the CVE is NOT in CISA KEV, and no public POC is referenced. This is therefore a genuinely severe-impact flaw but NOT evidence of imminent or widespread exploitation - a high-CVSS issue whose real-world exploitation risk is currently low. A critical caveat: a Graphics-component sandbox escape (CWE-693, Protection Mechanism Failure) is rarely exploitable in isolation - it typically must be chained with a separate content-process compromise to achieve full code execution on the host, which the SSVC 'Automatable: no' rating reflects. Patch urgency remains high for browser fleets given Firefox's ubiquity and the trivial AC:L/UI:R exploitation path once chained, but it is not a drop-everything emergency absent evidence of in-the-wild use.
Exploit ScenarioDerived	A victim is lured to an attacker-controlled web page (satisfying the UI:R requirement) that delivers crafted content exercising the flaw in Firefox's Graphics component. The flaw defeats the browser's sandbox protection, and when chained with a content-process compromise, lets the attacker escape the sandbox and execute code with the host user's privileges. No public exploit identified at time of analysis.

Act Now Prioritize within 24-48h. Why: CRITICAL severity.

No patch listed yet 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Oct 01, 2026

Sandbox escape in Mozilla Firefox's Graphics component allows unauthenticated remote attackers to break out of the browser's content sandbox when a victim renders attacker-controlled web content (CVSS vector AV:N/AC:L/PR:N/UI:R/S:C, score 9.6). Affected builds are Firefox before 157 and Firefox ESR before 153.4, 140.17, and 115.42, all of which now have vendor fixes available across their respective release trains. Exploitation requires chaining the escape with a separate content-process compromise to achieve code execution, which is consistent with CISA SSVC's 'Automatable: no' and 'Exploitation: none' ratings; EPSS is low at 0.16% (4th percentile) and no public exploit code has been identified at time of analysis.

RemediationAI

Vendor-released patches are available: upgrade to Firefox 157, Firefox ESR 153.4, Firefox ESR 140.17, or Firefox ESR 115.42 as applicable to your channel, with fixes documented in Mozilla advisories mfsa2026-97 through mfsa2026-103 and Bugzilla 2068367; organizations on the legacy ESR 115 branch should treat 115.42 as a stopgap and plan migration to the 140 ESR line, since older ESR branches receive narrower support. If immediate patching is not possible, targeted hardening that reduces the exposed Graphics attack surface includes setting webgl.disabled to true (breaks WebGL-based pages, 3D content, and some mapping/CAD web apps) and disabling hardware acceleration so compositing runs on the less privileged software path (degrades rendering, video playback, and battery performance); these are surface-reduction measures and are not vendor-confirmed mitigations for this specific defect. Because a sandbox escape alone does not yield code execution and must be chained with a separate content-process compromise, and given the low EPSS of 0.16% (4th percentile) and SSVC 'Exploitation: none', patch timing can be risk-weighted - but the CVSS 9.6 score, total technical impact, and the fact that graphics sandbox escapes are attractive as part of exploit chains argue for prioritizing patching on high-value, targeted-risk, or high-exposure endpoints rather than relying on compensating controls alone.

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

Firefox runs web content in a restricted content process that communicates with privileged GPU/compositor and parent processes over IPC; the Graphics component (WebGL, canvas, compositing, and the graphics IPC surface) is one of the interfaces where a content-process attacker can attempt to reach privileged code. CWE-693 (Protection Mechanism Failure) captures the root cause class here: the sandbox's isolation guarantees are bypassable, meaning the protection mechanism itself fails rather than a memory-safety bug being the primary defect. Because the CVSS vector has Scope Changed (S:C) with C:H/I:H/A:H, the assessed impact is total once the escape succeeds, yet a sandbox escape is by itself a boundary violation rather than a full code-execution chain - it must be combined with an independent content-process compromise, which is why CISA's SSVC rates technical impact 'total' while marking Exploitation 'none' and Automatable 'no'. Note that the automated 'Information Disclosure' tag attached to this CVE understates the assessed C:H/I:H/A:H impact and should be treated as low-fidelity metadata; the authoritative references are Mozilla Bugzilla 2068367 and advisories mfsa2026-97 through mfsa2026-103, which cover the affected release trains. The CPE string cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:* is version-wildcarded and does not distinguish standard Firefox from ESR branch builds, so version handling must come from the advisory text.

Know when Firefox gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (mozilla) PRIMARY 9.6 CRITICAL

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

vuln.today AI 9.6 CRITICAL

Web-delivered content needs user visit (AV:N/UI:R, PR:N); sandbox escape crosses a security boundary so S:C with full host C/I/A impact.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Red Hat 7.5 HIGH

Primary rating from Vendor (mozilla).

CVSS VectorVendor: mozilla

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

CVSS changed

Oct 01, 2026 - 16:22 NVD

9.6 (None) 9.6 (CRITICAL)

CVE Published

Sep 29, 2026 - 12:36 cve.org

UNKNOWN (no severity yet)

CVE Published

Sep 29, 2026 - 12:36 cve.org

CRITICAL 9.6

DescriptionCVE.org

Sandbox escape in the Graphics component. This vulnerability was fixed in Firefox ESR 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.

Executive ViewAI

Why It Matters

A critical sandbox-escape flaw in Mozilla Firefox's Graphics component can let a malicious or compromised web page break the browser's content sandbox on any unpatched Firefox or Firefox ESR build, meaning an ordinary browsing session by an employee could expose their endpoint. The escape alone does not yield full code execution - an attacker must also compromise the browser's content process - but that chain would turn routine web browsing into a system-level compromise path on corporate devices. Because Firefox is widely deployed across the workforce, leadership should treat this as a browser fleet patching priority with verification that no affected builds remain.

Business Impact: High

Compensating Controls

Apply vendor patch. While those builds are being deployed, exposure can be reduced by limiting rendering of untrusted web content for high-risk user groups and by confirming that the separate content-process compromise required for code execution is blocked by existing endpoint protection and browser hardening.

Threat Intelligence Overview

EPSS Score

0.2%

Top 96% exploitable

Prevalence

High

Firefox is a major, widely-deployed desktop browser across enterprise and consumer fleets

Data Quality

6 sources

Confidence: High

EUVD 🇯🇵JVN

NVD

CVE.org

EPSS

Vulnrichment Vendor

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity CRITICAL

CISA KEV No

Public POC No

EPSS 0.2%

Patch available No

Active threat No

Deciding rule

CRITICAL severity

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision

Scheduled

Exploitation

None

System Exposure· derived

Open

Automatable

Human Impact

High

Technical Impact

Total

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +48

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.