EUVD-2026-88931
GHSA-3768-46g2-cp8x
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessHost crafted XSLT/XML web page
-
DeliveryLure victim to open page
-
ExploitFirefox XSLT engine frees object
-
ExecutionReuse triggers use-after-free
-
PersistCorrupt content-process memory
-
ImpactExecute attacker code in browser
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to load attacker-controlled content that exercises Firefox's XSLT (XML stylesheet transformation) processing in an unpatched build (before Firefox 157, ESR 153.4, ESR 140.17, or ESR 115.42). No authentication or elevated privileges are needed (PR:N), but user interaction is required (UI:R): the target must open a malicious page or document - there is no server-side or zero-click path in the data. XSLT processing is a standard, enabled-by-default browser capability, so no special non-default configuration is required beyond the victim rendering the hostile content. |
| Impact | The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, 8.8 High) reflects a client-side memory-corruption flaw: network-reachable and requiring no privileges, but gated by user interaction (UI:R) - the victim must load attacker-controlled content that triggers the XSLT engine. This is not a server-side unauthenticated RCE despite the network vector; the UI:R requirement meaningfully lowers real-world exploitability versus a drive-by-with-no-interaction bug. No EPSS score, no CISA KEV listing, and no public POC are present in the provided data, so there is no evidence of active exploitation or a widely-available exploit. Signals are internally consistent and non-conflicting. Mozilla self-reported (likely fuzzing/internal discovery), which is typical for browser memory-safety bugs and correlates with no in-the-wild activity. Net: a genuinely serious bug in a ubiquitous product warranting prompt patching, but priority is moderate rather than emergency - no confirmed exploitation and interaction is required. Note the 'Information Disclosure' tag understates impact: the CWE-416 UAF yields memory corruption (RCE-class C/I/A:H), not merely info leak. |
| Exploit ScenarioDerived | An attacker hosts a malicious web page (or injects content into a site the victim visits) containing crafted XSLT/XML that triggers the use-after-free in Firefox's XSLT component. When the victim's browser processes the document, the freed object is reused, corrupting memory and potentially allowing arbitrary code execution in the content process. No public POC or exploit code is identified at time of analysis, and successful exploitation requires the victim to load the page (UI:R). |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 29, 2026
A use-after-free in Mozilla Firefox's XSLT (XML stylesheet transformation) engine can be triggered when a victim loads attacker-controlled content that exercises stylesheet processing, allowing memory corruption that jeopardizes confidentiality, integrity, and availability of the browser session. The flaw affects Firefox builds prior to 157, ESR 153.4, ESR 140.17, and ESR 115.42, and requires no privileges (PR:N) but does require user interaction (UI:R) - the target must open a malicious page or XML document, with no zero-click or server-side path indicated by the available data. Mozilla has released fixed versions across all supported release and ESR channels; no public exploit code was identified at time of analysis.
RemediationAI
Vendor-released patches are available: upgrade to Firefox 157 (release channel), Firefox ESR 153.4, Firefox ESR 140.17, or Firefox ESR 115.42, matching whichever channel the deployment tracks, per Mozilla advisories mfsa2026-100, mfsa2026-99, mfsa2026-98, and mfsa2026-97 (linked from Bugzilla bug 2068417). Prioritize ESR 115.x and 140.x fleets, since those branches are typically pinned by enterprises and will not auto-advance unless update policy allows; verify that enterprise policies such as App Update or DisableAppUpdate are not blocking the upgrade, which is a common cause of stale ESR installs. Because XSLT transformation is enabled by default and Firefox exposes no supported preference to globally disable XML stylesheet processing without breaking standards-compliant content, the patch is the only reliable fix; compensating controls are partial at best. Blocking or sanitizing untrusted XML/XSL content at the network gateway or proxy reduces exposure from direct document loads, but it will not stop attacks that invoke XSLTProcessor from JavaScript inside an otherwise benign-looking HTML page, and overly aggressive XML filtering can break legitimate enterprise document workflows. Disabling JavaScript provides only partial protection and carries a large functional trade-off - it blocks the script-driven XSLTProcessor path but does not stop stylesheet processing instructions in XML documents. Deploying the browser in a sandboxed or low-privilege context limits the blast radius if exploitation succeeds, and restricting users to trusted content sources lowers the likelihood of encountering a malicious page while patched rollout completes.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is a use-after-free (CWE-416) inside Firefox's XSLT processing path. XSLT is a W3C-standard, enabled-by-default browser capability that transforms XML source documents using stylesheets, either through an xml-stylesheet processing instruction embedded in a document or programmatically via the XSLTProcessor JavaScript API. During transformation the engine builds and tears down a tree of nodes and compiled stylesheet objects; a use-after-free means an object is released while a reference to it is still reachable, so subsequent access reads or writes memory that may have been reallocated. That class of bug typically manifests as memory corruption that can be steered toward arbitrary code execution inside the browser's content process, or at minimum as an information disclosure if freed memory contents leak. The CVSS vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H (8.8 High) is consistent with a remotely reachable, low-complexity client-side memory-safety defect that is gated only by the victim rendering hostile content. The CPE record cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:* indicates the entry tracks the Firefox product line generically, with the specific fixed versions enumerated in Mozilla security advisories mfsa2026-97 through mfsa2026-100.
Know when Firefox gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Network-delivered web content, no privileges, but victim must load the page (UI:R); a content-process UAF plausibly yields full memory corruption, so C/I/A:H; no scope change assumed.
Primary rating from Vendor (mozilla).
CVSS VectorVendor: mozilla
Lifecycle Timeline
3DescriptionCVE.org
Use-after-free in the XSLT component. This vulnerability was fixed in Firefox ESR 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.
Executive ViewAI
Mozilla Firefox versions prior to 157, ESR 153.4, ESR 140.17, and ESR 115.42 are affected by a use-after-free vulnerability in the XSLT engine that can cause memory corruption and compromise the confidentiality, integrity, and availability of user browser sessions. Exploitation requires user interaction, such as opening a malicious webpage or XML document, and no public exploit code has been identified at this time. Because Firefox is widely deployed, unpatched systems represent a significant organizational risk that warrants immediate remediation.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Affected Products (CPE)CVE.org
Mozilla Firefox before 18.0, Firefox ESR 10.x before 10.0.12 and 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderb
Use-after-free vulnerability in the serializeToStream implementation in the XMLSerializer component in Mozilla Firefox b
The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbi
The crypto.generateCRMFRequest function in Mozilla Firefox before 23.0, Firefox ESR 17.x before 17.0.8, Thunderbird befo
The XrayWrapper implementation in Mozilla Firefox before 35.0 and SeaMonkey before 2.32 does not properly interact with
The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 18.0, Firefox ESR 17.x before 17.0.2, Thunderbi
The Web IDL implementation in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and Se
Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and SeaMonkey before 2.25 allow remo
Integer underflow in the nsHtml5TreeBuilder class in the HTML5 string parser in Mozilla Firefox before 45.0 and Firefox
Mozilla Firefox before 37.0, Firefox ESR 31.x before 31.6, and Thunderbird before 31.6 do not properly restrict resource
Mozilla Firefox before 37.0 relies on docshell type information instead of page principal information for Window.webidl
The RC4 algorithm, as used in the TLS protocol and SSL protocol, has many single-byte biases, which makes it easier for
Exploit-DB