What is the CVSS score of CVE-2026-100788?

CVE-2026-100788 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

How to fix or mitigate CVE-2026-100788?

Within 24 hours, inventory all Firefox installations to identify versions prior to 157, Firefox ESR prior to 153.4, and Firefox ESR prior to 140.17, and flag them as vulnerable; since no vendor patch is currently available, instruct users to avoid untrusted websites and enable strict content blocking. Within 7 days, deploy network-level protections such as web filtering and intrusion detection signatures for known exploitation patterns, and evaluate migrating critical users to an alternative browser until a patch is released. Within 30 days, monitor Mozilla's advisory for the release of Firefox 157, Firefox ESR 153.4, or Firefox ESR 140.17, and apply the patch immediately upon availability; if the patch is delayed, continue compensating controls and reassess risk.

Mozilla Firefox CVE-2026-100788

EUVD-2026-88940 CRITICAL

Access of Uninitialized Pointer (CWE-824)

2026-09-29 mozilla

GHSA-q45r-899q-qwvr

Information Disclosure Memory Corruption Red Hat Mozilla Firefox

9.8

CVSS 3.1 · Vendor: mozilla

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Lure victim to malicious page
Delivery

Deliver crafted WASM/JS payload
Exploit

Trigger invalid pointer in WASM engine
Execution

Corrupt content-process memory
Impact

Achieve code execution or info disclosure

Vulnerability Assessment

Weakness	CWE CWE-824 ASVS 5.0 V15 - Secure Coding and Architecture Uninitialized pointer prevention MITRE ATT&CK 1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Exploitation Conditions	Requires the victim to load attacker-controlled web content (a malicious or compromised page) in a vulnerable Firefox build; the flaw lives in the JavaScript/WebAssembly engine, so the page must deliver crafted WASM/JS to reach the invalid-pointer code path. No authentication is needed, but exploitation is gated by user interaction (navigation to the content) and by the running version being pre-patch (before Firefox 157, ESR 153.4, or ESR 140.17). Full host compromise beyond the content process would further require defeating the Firefox sandbox. Affects default configurations since WASM/JS execution is enabled by default.
Impact	Signals conflict and should be reconciled before treating this as an emergency. The input CVSS is 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), but that vector is not Mozilla-sourced and is inflated for a browser memory-safety bug: a WebAssembly/JavaScript invalid-pointer flaw (CWE-824) cannot be triggered against Firefox without a victim navigating to attacker-controlled content, so UI:N is wrong - UI:R is correct, lowering the realistic base score to roughly 8.8. EPSS is only 0.16% (4th percentile), there is no CISA KEV listing, and no public exploit code was identified, so despite the high nominal CVSS the near-term, at-scale exploitation probability is LOW. CWE-824 (access of uninitialized/invalid pointer) in a JIT/WASM engine is a classic path to memory corruption and potentially content-process code execution or info disclosure, but weaponizing it typically requires a non-trivial exploit chain and, for full host compromise, a sandbox escape. Net: a genuinely serious bug worth prompt patching given Firefox's footprint, but current evidence points to it being important-not-emergency rather than an actively-exploited priority.
Exploit ScenarioDerived	An attacker hosts a web page containing crafted JavaScript/WebAssembly that triggers the invalid-pointer condition in Firefox's WASM engine and lures or redirects a victim to it (malvertising, phishing link, compromised site). Successful triggering corrupts memory in the content process, potentially leading to arbitrary code execution within the sandbox or information disclosure. No public proof-of-concept or active exploitation has been identified at time of analysis, and full host compromise would additionally require a sandbox escape.

Act Now Prioritize within 24-48h. Why: CRITICAL severity.

No patch listed yet 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Oct 01, 2026

Memory corruption in Mozilla Firefox's JavaScript and WebAssembly engine (CWE-824, access of uninitialized pointer) allows a crafted or compromised web page to trigger an invalid-pointer dereference in the browser's content process, potentially resulting in information disclosure or code execution within that process. Exploitation requires the victim to navigate to attacker-controlled content in a pre-patch build - Firefox before 157, Firefox ESR before 153.4, or Firefox ESR before 140.17 - and is unauthenticated per the assessed CVSS vector (AV:N/PR:N), although the vendor's 9.8 score assumes no user interaction while our independent assessment requires UI:R, so the effective risk should be reconciled before treating this as an emergency. No public exploit code has been identified at time of analysis (no KEV listing, no POC) and EPSS is 0.16% (4th percentile), indicating low predicted exploitation activity.

RemediationAI

Vendor-released patches are available: upgrade to Firefox 157, Firefox ESR 153.4, or Firefox ESR 140.17 depending on the channel in use, referencing Mozilla advisories MFSA 2026-97, MFSA 2026-99, MFSA 2026-100, MFSA 2026-101, MFSA 2026-102, and MFSA 2026-103. Where immediate upgrade is not feasible, the most targeted compensating control is to disable WebAssembly by setting javascript.options.wasm to false in about:config or by enforcing an enterprise policy that turns off WASM, which blocks the affected code path but will break legitimate WASM-dependent web applications; disabling JavaScript entirely is broader and far more disruptive, and restricting users to trusted sites is only a partial mitigation. Because exploitation is gated by user interaction and confined to the content process, keep the Firefox sandbox and site-isolation features enabled while patching is staged to reduce the impact of any successful trigger.

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

The defect resides in SpiderMonkey's WebAssembly implementation, where an uninitialized or otherwise invalid pointer is accessed (CWE-824), producing a memory-corruption condition inside the Firefox content process. WebAssembly is a portable binary instruction format executed alongside JavaScript in Firefox; both JS and WASM execution are enabled by default in standard configurations, so no special feature toggle is required to reach the vulnerable code path when a page delivers the right crafted WASM/JS payload. Successful corruption could yield information disclosure or further memory manipulation, but because the code runs inside the Firefox content sandbox, full host compromise beyond the content process would require an additional sandbox-escape primitive. The CPE entry cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:* identifies the main Firefox product, and the same engine fix is shipped across the Firefox and ESR update channels described in Mozilla advisories MFSA 2026-97, MFSA 2026-99, MFSA 2026-100, MFSA 2026-101, MFSA 2026-102, and MFSA 2026-103, with bug 2072413 tracking the underlying issue.

Know when Firefox gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (mozilla) PRIMARY 9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI 8.8 HIGH

Browser engine bug reachable only when a victim loads malicious content, so UI:R rather than UI:N; no privileges needed and memory corruption can plausibly yield high C/I/A within the content process.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Red Hat 7.5 HIGH

Primary rating from Vendor (mozilla).

CVSS VectorVendor: mozilla

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

CVSS changed

Oct 01, 2026 - 15:22 NVD

9.8 (CRITICAL)

CVE Published

Sep 29, 2026 - 12:36 cve.org

UNKNOWN (no severity yet)

CVE Published

Sep 29, 2026 - 12:36 cve.org

CRITICAL 9.8

DescriptionCVE.org

Invalid pointer in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox ESR 153.4, Firefox 157, and Firefox ESR 140.17.

Executive ViewAI

Why It Matters

Mozilla Firefox's JavaScript and WebAssembly engine is affected by a critical memory corruption vulnerability that could allow an attacker to execute code or disclose sensitive information when a user visits a malicious webpage. Organizations with users running affected Firefox versions (before 157, ESR before 153.4, or ESR before 140.17) face potential endpoint compromise, though exploitation requires user interaction and no public exploit has been identified. Leadership should prioritize mitigation and monitor for a vendor patch, as the high severity combined with the absence of a fix elevates organizational risk.

Business Impact: High

Compensating Controls

No vendor-released patch identified at time of analysis. Interim mitigations include restricting browsing to trusted sites, implementing network-based detection and web filtering, enabling browser security features like site isolation and enhanced tracking protection, and user education to avoid suspicious links. Consider temporary use of alternative browsers for high-risk users.

Threat Intelligence Overview

EPSS Score

0.2%

Top 96% exploitable

Prevalence

High

major cross-platform browser including enterprise ESR, broad deployment

Data Quality

5 sources

Confidence: Medium

EUVD

NVD

CVE.org

EPSS

Vulnrichment Vendor

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity CRITICAL

CISA KEV No

Public POC No

EPSS 0.2%

Patch available No

Active threat No

Deciding rule

CRITICAL severity

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision

Scheduled

Exploitation

None

System Exposure· derived

Open

Automatable

Yes

Human Impact

High

Technical Impact

Total

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +49

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Memory Corruption HIGH

Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.