What is the CVSS score of CVE-2026-100780?

CVE-2026-100780 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

How to fix or mitigate CVE-2026-100780?

Within 24 hours, apply the vendor-released patch: Firefox 157, Firefox ESR 153.4, Firefox ESR 140.17, or Firefox ESR 115.42. Identify all Firefox installations across the organization and update them immediately. If immediate patching is not feasible, enforce strict browser sandboxing and restrict user permissions to reduce exploit impact. Within 7 days, verify that all endpoints have been updated and enable automatic updates for Firefox to prevent future exposure. Within 30 days, conduct a review of browser security configurations, enhance user awareness training on phishing and malicious websites, and monitor threat intelligence for any signs of exploitation, noting that no public exploit identified at time of analysis.

Mozilla Firefox CVE-2026-100780

EUVD-2026-88932 HIGH

Use After Free (CWE-416)

2026-09-29 mozilla

GHSA-wmqw-hpqq-jp4m

Information Disclosure Use After Free Memory Corruption Red Hat Mozilla Firefox

8.8

CVSS 3.1 · Vendor: mozilla

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Host crafted malicious web page
Delivery

Lure victim to load page in Firefox
Exploit

Trigger use-after-free in DOM Core/HTML
Execution

Reallocate freed object to corrupt memory
Impact

Execute attacker code in content process

Vulnerability Assessment

Weakness	CWE CWE-416 ASVS 5.0 V15 - Secure Coding and Architecture Memory lifecycle management MITRE ATT&CK 2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Exploitation Conditions	Exploitation requires the victim to actively load attacker-controlled web content in an unpatched Firefox (UI:R) - there is no server-side or unauthenticated remote-service exposure; the flaw lives in client-side DOM Core & HTML rendering. No special product configuration is needed since it affects default browsing, but success depends on winning the use-after-free reallocation and defeating browser sandboxing/mitigations, and it is limited to versions before Firefox 157, ESR 153.4, ESR 140.17, and ESR 115.42.
Impact	All signals point to a browser memory-corruption bug of standard severity for the class, not an emergency. CVSS 3.1 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) is internally consistent with the description: network-reachable via a crafted web page, low complexity, no privileges, but requiring user interaction (victim must load attacker content). I concur with the 8.8. Critically, exploitation status is 'no public exploit identified at time of analysis' - there is no EPSS score, no CISA KEV listing, and no POC in the provided data; this is a Mozilla self-reported/self-fixed defect disclosed alongside the fix, which is the normal pattern for internally-found browser UAFs. No SSVC framing is supplied. Note the CVSS C:H/I:H/A:H reflects the memory-corruption/RCE-class ceiling of a UAF, whereas the 'Information Disclosure' tag understates it - this is memory corruption, not merely an info leak. Bottom line: real but routine - high theoretical impact, no evidence of active or imminent exploitation, and mitigated in practice by the UI:R requirement and the availability of a patch.
Exploit ScenarioDerived	An attacker hosts a malicious web page that manipulates DOM Core/HTML objects to trigger a use-after-free, then lures a victim running an unpatched Firefox to visit it (e.g., via a link or malvertising). Freeing and reallocating the dangling object lets the attacker corrupt memory in the content process, potentially achieving arbitrary code execution within the browser sandbox. No public POC or exploit is identified in the provided data.

This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).

No patch listed yet 0.3% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Sep 29, 2026

A use-after-free flaw in Firefox's DOM Core & HTML component (CWE-416) can corrupt browser memory when a victim loads attacker-controlled web content, with a CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). All supported release channels are affected below the fixed builds - Firefox 157, Firefox ESR 153.4, Firefox ESR 140.17, and Firefox ESR 115.42 - and the flaw is exploitable by unauthenticated remote attackers only if the user actively visits or is induced to load a malicious page (UI:R), with no server-side exposure. No public exploit code and no confirmed active exploitation were identified at time of analysis; impact ranges from information disclosure and memory corruption to a potentially exploitable crash or code execution, though reliable exploitation requires winning the heap reallocation race and defeating browser sandbox mitigations, placing it in the normal severity band for this bug class rather than an emergency.

RemediationAI

Vendor-released patches fix this issue in Firefox 157 and in the ESR channels Firefox ESR 153.4, Firefox ESR 140.17, and Firefox ESR 115.42, so the primary action is to upgrade to or above the build matching your deployment channel and, for organizations, enforce that version through enterprise policy to prevent silent regressions. Because Firefox auto-updates by default, verify that update enforcement has not been disabled and monitor MFSA 2026-100, MFSA 2026-99, MFSA 2026-98, and MFSA 2026-97 (linked at https://www.mozilla.org/security/advisories/mfsa2026-100/) plus Bugzilla 2068422 for any revision. No vendor-released patch was identified at time of analysis beyond these fixed versions, so until upgrade is possible the practical compensating controls are to keep the browser's process sandbox and site isolation enabled, avoid opening untrusted or unsolicited links in unpatched builds, and rely on enterprise content filtering or network-level blocking of suspicious sites - with the trade-off that these are partial, probabilistic defenses since the flaw is triggered by ordinary page rendering, and disabling JavaScript or the DOM features involved is not a realistic mitigation for general browsing. Isolating high-risk browsing to a separate, fully updated browser profile or sandboxed environment reduces the blast radius but does not eliminate exposure for users who continue browsing the web in the vulnerable build.

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

The vulnerability is a use-after-free (CWE-416) inside the DOM: Core & HTML implementation that underpins document parsing, node tree construction, and event/element handling in Gecko. A freed DOM-related object can be referenced again after its memory has been released, so an attacker who controls page content - markup, script, or element lifecycles - may be able to reclaim that freed allocation with data of their choosing and induce memory corruption. The Intel-tagged reference CPE (cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*) confirms the affected platform is Mozilla's browser across release and ESR channels, and the accompanying tags (Use After Free, Memory Corruption, Information Disclosure) align with the CWE class. The CVSS vector's PR:N plus UI:R reflects a classic client-side, drive-by pattern: no credentials are required, but the victim must render the malicious content, and the practical ceiling on impact depends on whether the corrupted object can be leveraged past Firefox's process sandbox and exploit mitigations.

Know when Firefox gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (mozilla) PRIMARY 8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI 8.8 HIGH

Network-delivered crafted page (AV:N) needing victim to load it (UI:R), no privileges, content-process memory corruption yielding full C/I/A within an unchanged scope.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Red Hat 7.5 HIGH

Primary rating from Vendor (mozilla).

CVSS VectorVendor: mozilla

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

CVSS changed

Sep 29, 2026 - 15:22 NVD

8.8 (HIGH)

CVE Published

Sep 29, 2026 - 12:36 cve.org

HIGH 8.8

CVE Published

Sep 29, 2026 - 12:36 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox ESR 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.

Executive ViewAI

Why It Matters

A high-severity use-after-free vulnerability in Mozilla Firefox's DOM Core & HTML component (CVE-2026-100780) affects all supported release channels below fixed builds, potentially leading to memory corruption and code execution when users load malicious web content. Although no public exploit identified at time of analysis, the flaw is remotely exploitable by unauthenticated attackers if a user visits a crafted page, posing a risk of data compromise or endpoint takeover across the organization. Leadership should prioritize updating Firefox to the vendor-fixed versions to mitigate this threat.

Business Impact: High

Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

EPSS Score

0.3%

Top 75% exploitable

Prevalence

Ubiquitous

Firefox is a mainstream browser deployed across desktops worldwide

Data Quality

6 sources

Confidence: High

EUVD 🇯🇵JVN

NVD

CVE.org

EPSS

Vulnrichment Vendor

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity HIGH

CISA KEV No

Public POC No

EPSS 0.3%

Patch available No

Active threat No

Deciding rule

HIGH severity (CVSS 7.0-8.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision

Scheduled

Exploitation

None

System Exposure· derived

Open

Automatable

Human Impact

High

Technical Impact

Total

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +44

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Use After Free HIGH

Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.

Memory Corruption HIGH

Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.