What is the CVSS score of CVE-2026-100778?

CVE-2026-100778 has a CVSS 3.1 base score of 9.6 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

How to fix or mitigate CVE-2026-100778?

Within 24 hours, inventory all Firefox and Firefox ESR installations across managed endpoints and identify any build below Firefox 157 or ESR 153.4, 140.17, and 115.42, prioritizing finance, engineering, and administrative users; where Firefox cannot be immediately replaced, restrict those users to an approved browser (Chrome, Edge, or Safari) for untrusted internet browsing and enforce strict Enhanced Tracking Protection and site isolation while disabling unneeded plugins and restricting administrative/privileged activity on the same host. Within 7 days, apply the vendor-released patched builds for Firefox (157) and ESR (153.4, 140.17, 115.42) if they become available, push them through your software deployment pipeline, and in the interim deploy endpoint detection rules for browser child-process spawning shells or unusual host-level execution, isolate high-risk browsing to hardened virtual machines or remote browsing services, and block known-malicious domains at the secure web gateway. Within 30 days, confirm 100% patch coverage against the fixed versions, retire or upgrade end-of-life ESR branches that cannot reach a supported build, re-validate browser hardening baselines and privilege policies, and monitor the Mozilla advisory and CISA KEV catalog for changes in exploitation status so mitigations can be tightened if active exploitation is confirmed.

Mozilla Firefox CVE-2026-100778

EUVD-2026-88930 CRITICAL

Use After Free (CWE-416)

2026-09-29 mozilla

GHSA-jm26-3479-fr7j

Information Disclosure Use After Free Memory Corruption Red Hat Mozilla Firefox

9.6

CVSS 3.1 · Vendor: mozilla

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Lure victim to crafted web page
Delivery

Malicious DOM/HTML triggers use-after-free
Exploit

Corrupt content-process memory
Execution

Escape sandbox to host
Impact

Execute code with full C/I/A impact

Vulnerability Assessment

Weakness	CWE CWE-416 ASVS 5.0 V15 - Secure Coding and Architecture Memory lifecycle management MITRE ATT&CK 2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Exploitation Conditions	Exploitation requires a victim using an unpatched Firefox (before 157, or ESR before 153.4/140.17/115.42) to load attacker-controlled web content that triggers the use-after-free in the DOM Core & HTML engine - no authentication or special product configuration is needed, and this affects default browser behavior. The primary limiting factor is user interaction (UI:R): the victim must navigate to or render the malicious page; there is no unauthenticated server-side or zero-click vector, and no public POC is available to lower the exploitation barrier.
Impact	This is a genuinely high-priority memory-corruption flaw. The CVSS 9.6 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H) is credible and consistent with a use-after-free that produces a sandbox escape: the S:C (scope change) reflects escaping the content process to affect the host system, which is why this scores higher than the many 8.8 (S:U) sibling UAFs in the same Firefox batch (e.g. the DOM Core & HTML UAFs CVE-2026-100774/100785/100791). Exploitation is network-delivered (AV:N) via a crafted web page but requires victim interaction (UI:R) to visit that page, so it is not wormable/automatable. On the exploitation-signal side there is NO EPSS score, NO CISA KEV listing, and NO public POC provided; Mozilla self-reported this through MFSA advisories with no indication of in-the-wild use. So the severity is real and RCE-class, but current evidence points to no active exploitation - the priority comes from Firefox's ubiquity and the sandbox-escape impact, not from observed attacker activity. No conflicting signals in the CVSS vector itself; PR:N and AV:N are consistent with a drive-by web-content attack.
Exploit ScenarioDerived	An attacker hosts a malicious web page that drives Firefox's DOM Core & HTML code into a use-after-free; a victim simply visiting the page (UI:R) triggers memory corruption in the content process, which is then leveraged to escape the sandbox (S:C) and gain code execution on the host. No public exploit code or POC is identified at time of analysis, and no authentication is required (PR:N).

Act Now Prioritize within 24-48h. Why: CRITICAL severity.

No patch listed yet 0.3% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Sep 29, 2026

Use-after-free in Mozilla Firefox's DOM Core & HTML engine allows attacker-controlled web content to corrupt memory and escape the browser's content sandbox, potentially yielding code execution at higher privilege on the host. Affected are Firefox builds prior to 157 and ESR branches prior to 153.4, 140.17, and 115.42; the flaw is rated CVSS 9.6 (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H), so no authentication or non-default configuration is required, but a victim must load or render a malicious page (UI:R). No public exploit code has been identified at time of analysis, and the vulnerability has not been confirmed as actively exploited, though the scope-changed rating reflects that a successful trigger crosses a security boundary rather than merely crashing a content process.

RemediationAI

Vendor-released patch: upgrade to Mozilla Firefox 157, Firefox ESR 153.4, Firefox ESR 140.17, or Firefox ESR 115.42 (choose the build matching your deployed channel); these versions are the exact fixes named in the vendor advisories https://www.mozilla.org/security/advisories/mfsa2026-97/, https://www.mozilla.org/security/advisories/mfsa2026-98/, https://www.mozilla.org/security/advisories/mfsa2026-99/, and https://www.mozilla.org/security/advisories/mfsa2026-100/. Because the defect lives in the DOM Core & HTML engine that every page depends on, there is no reliable configuration toggle that removes the attack surface: disabling JavaScript would block the script-driven trigger but breaks the majority of modern web applications and does not protect against parser-triggered paths, while merely raising site-isolation or content-process restrictions does not fix the underlying use-after-free and at best blunts post-corruption lateral movement. If immediate updating is impossible, restrict browsing to a curated allowlist of trusted sites, prefer higher-isolation configurations (strict content-process separation, hardened sandboxing, disabling unnecessary plugins and extensions), and monitor for unexpected browser-process crashes or child-process behavior changes as a rough compromise indicator - noting each of these reduces exposure but does not eliminate the flaw. Confirm patch state via the browser's own version page or your software inventory, and treat ESR 115.x deployments as requiring an explicit move to 115.42 or a supported newer ESR line rather than assuming end-of-life coverage. The upstream bug record is https://bugzilla.mozilla.org/show_bug.cgi?id=2068406.

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

The root cause is CWE-416 (use-after-free) in the DOM: Core & HTML component, the code that parses and maintains the document object model inside Firefox's content process. A dangling reference to a freed DOM object can be reused by script-driven or parser-driven manipulation, producing memory corruption that, in a browser, is a classic path to arbitrary code execution within the sandboxed content process and - because the CVSS vector specifies S:C (scope changed) - an escape past that sandbox boundary. The CPE entry cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:* uses a version wildcard, consistent with a defect present across the currently maintained release and ESR trains and fixed only at the listed branch points (Firefox 157, ESR 153.4, ESR 140.17, ESR 115.42). Associated tags of Use After Free, Memory Corruption, and Information Disclosure align with a memory-safety bug that may also leak data before or during corruption, and the flaw is tracked upstream in Mozilla bug 2068406 with advisories mfsa2026-97, -98, -99, and -100 covering the affected channels.

Know when Firefox gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (mozilla) PRIMARY 9.6 CRITICAL

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

vuln.today AI 9.6 CRITICAL

Web-delivered UAF needing only a page visit (AV:N/AC:L/PR:N/UI:R); sandbox escape crosses the content-process boundary to the host, giving S:C with full C/I/A.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Red Hat 7.5 HIGH

Primary rating from Vendor (mozilla).

CVSS VectorVendor: mozilla

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

CVSS changed

Sep 29, 2026 - 17:22 NVD

9.6 (CRITICAL)

CVE Published

Sep 29, 2026 - 12:36 cve.org

UNKNOWN (no severity yet)

CVE Published

Sep 29, 2026 - 12:36 cve.org

CRITICAL 9.6

DescriptionCVE.org

Sandbox escape due to use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox ESR 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.

Articles & Coverage 1

News Critical UAF RCE Sandbox Escape in Mozilla Firefox - CVE-2026-100778 Sep 30, 2026

Executive ViewAI

Why It Matters

A critical memory-corruption flaw in Mozilla Firefox's core rendering engine can allow a malicious web page to break out of the browser's content sandbox and execute code at the host level, meaning a single ordinary browsing session could be enough to compromise an endpoint. Because Firefox is widely deployed across the workforce and no vendor patch exists yet, every employee who browses the open internet from an unpatched Firefox build represents an unmitigated path into the corporate environment. Leadership should treat this as a near-term endpoint exposure with potential for credential theft, lateral movement, and data loss until remediated builds ship.

Business Impact: High

Compensating Controls

No vendor-released patch identified at time of analysis. Interim mitigations: mandate an alternative fully patched browser for untrusted internet browsing on affected hosts; enforce strict Enhanced Tracking Protection, site isolation, and disable unnecessary extensions/plugins; restrict privileged or administrative work to separate hardened systems; isolate high-risk browsing in virtual machines or a remote browser isolation service; apply secure web gateway and DNS filtering to block malicious content; deploy EDR detections for browser processes spawning unexpected child processes or performing host-level execution; and monitor the Mozilla security advisory and CISA KEV catalog daily for patched builds or confirmed exploitation.

Threat Intelligence Overview

EPSS Score

0.3%

Top 75% exploitable

Prevalence

Ubiquitous

Mozilla Firefox is one of the most widely deployed desktop browsers worldwide

Data Quality

6 sources

Confidence: High

EUVD 🇯🇵JVN

NVD

CVE.org

EPSS

Vulnrichment Vendor

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity CRITICAL

CISA KEV No

Public POC No

EPSS 0.3%

Patch available No

Active threat No

Deciding rule

CRITICAL severity

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision

Scheduled

Exploitation

None

System Exposure· derived

Open

Automatable

Human Impact

High

Technical Impact

Total

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +48

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Use After Free HIGH

Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.

Memory Corruption HIGH

Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.