What is the CVSS score of CVE-2026-100793?

CVE-2026-100793 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.1%.

Mozilla Firefox CVE-2026-100793

EUVD-2026-88945 MEDIUM

Access of Resource Using Incompatible Type (Type Confusion) (CWE-843)

2026-09-29 mozilla

GHSA-2543-qv62-jgqp

Information Disclosure Memory Corruption Red Hat Mozilla Firefox

6.5

CVSS 3.1 · Vendor: mozilla

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Host malicious JS page
Delivery

Lure victim to browse (UI:R)
Exploit

Trigger JIT miscompilation/type confusion
Execution

Read out-of-bounds process memory
Impact

Exfiltrate disclosed data

Vulnerability Assessment

Weakness	CWE CWE-843 ASVS 5.0 V15 - Secure Coding and Architecture Type safety enforcement MITRE ATT&CK 1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Exploitation Conditions	Requires a victim using an unpatched Firefox (before version 157) to load an attacker-controlled web page containing JavaScript crafted to trigger the JIT miscompilation - the JIT compiler is enabled by default, so no special victim configuration is needed. Exploitation is gated by UI:R (the user must visit or be redirected to the malicious page); there is no authentication requirement (PR:N). Impact is limited to information disclosure within the content process (no integrity or availability impact, no scope change), and Firefox's automatic update mechanism shrinks the realistic exposure window.
Impact	Signals are consistent and point to a MEDIUM, important-not-emergency issue rather than an urgent priority. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N, 6.5) describes a remotely-reachable, low-complexity, unauthenticated flaw that nonetheless requires user interaction (UI:R - the victim must browse to attacker content) and is capped at confidentiality impact only (C:H/I:N/A:N). EPSS is low at 0.15% (4th percentile), it is NOT on CISA KEV, and no public exploit is identified, so there is no evidence of widespread or imminent exploitation. The one tension worth noting: CWE-843 type confusion from JIT miscompilation is historically a strong primitive for memory corruption and sometimes RCE, yet Mozilla scopes the impact here to information disclosure (C:H, no integrity/availability) - treat the H confidentiality as the authoritative ceiling unless the vendor revises it. Firefox's auto-update channel materially reduces real-world exposure window.
Exploit ScenarioDerived	An attacker hosts a web page containing JavaScript crafted to trigger the JIT miscompilation / type confusion in Firefox's JavaScript engine and lures or redirects a victim running an unpatched Firefox to visit it. When the engine mis-optimizes the code, the resulting type confusion lets the attacker read memory it should not, disclosing sensitive in-process data (e.g., cross-origin content or other secrets in the content process). No public exploit code has been identified at time of analysis.

This Month Plan within 30 days. Why: MEDIUM severity (CVSS 4.0-6.9).

No patch listed yet 0.1% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Oct 01, 2026

Mozilla Firefox before 157 can disclose sensitive process memory to a remote, unauthenticated attacker who persuades a user to load a crafted JavaScript page, because the browser's JavaScript JIT compiler can miscompile code and trigger a type-confusion condition. Exploitation requires user interaction (the victim must visit or be redirected to attacker-controlled content), and impact is limited to confidentiality within the content process; Mozilla fixed the issue in Firefox 157, and no public exploit code has been identified at the time of analysis, with EPSS at 0.15% (4th percentile).

RemediationAI

Upgrade to Mozilla Firefox 157 or later, the vendor-released patched version according to Mozilla advisories MFSA2026-97 and MFSA2026-101; use the browser's automatic update mechanism or enterprise deployment tools to ensure all Firefox instances are updated, because automatic updates substantially shrink the exposure window. If immediate upgrade is impossible, avoid browsing untrusted sites with the unpatched browser or use a different browser for risky content, and consider disabling JavaScript entirely via strict browser settings or a script-blocking extension as a last resort; this prevents the crafted script from reaching the JIT compiler but breaks most modern web applications and is not a sustainable broad mitigation. Network filtering is unlikely to help because the malicious JavaScript arrives as ordinary web content; prioritization should reflect the medium severity, the UI:R prerequisite, the confidentiality-only impact, and the absence of observed public exploitation.

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

The flaw is a JIT miscompilation in Firefox's JavaScript engine (SpiderMonkey), classified as CWE-843 (type confusion). The JIT compiler, enabled by default, translates JavaScript into optimized native code; a miscompilation can cause the engine to treat an object as an incompatible type, leading to memory corruption that an attacker can shape into information disclosure. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N shows a network-delivered, low-complexity attack with no authentication, but it requires a user to load the malicious page; there is no integrity or availability impact and no scope change, which confines the practical impact to reading browser/content-process memory rather than code execution or data modification. The CPE data identifies Mozilla Firefox as the affected product, and Mozilla advisories MFSA2026-97 and MFSA2026-101 document the fix in Firefox 157.

Know when Firefox gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (mozilla) PRIMARY 6.5 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

vuln.today AI 6.5 MEDIUM

Remote attacker-hosted page with no auth (AV:N/PR:N) but victim must browse to it (UI:R); vendor scopes impact to information disclosure only, so C:H, I:N, A:N, no scope change.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Red Hat 7.5 HIGH

Primary rating from Vendor (mozilla).

CVSS VectorVendor: mozilla

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

CVSS changed

Oct 01, 2026 - 15:22 NVD

6.5 (MEDIUM)

CVE Published

Sep 29, 2026 - 12:36 cve.org

UNKNOWN (no severity yet)

CVE Published

Sep 29, 2026 - 12:36 cve.org

MEDIUM 6.5

DescriptionCVE.org

JIT miscompilation in the JavaScript Engine component. This vulnerability was fixed in Firefox 157.

Threat Intelligence Overview

EPSS Score

0.1%

Top 96% exploitable

Prevalence

High

Firefox is a major, widely-deployed desktop/enterprise web browser

Data Quality

5 sources

Confidence: Medium

EUVD

NVD

CVE.org

EPSS

Vulnrichment Vendor

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity MEDIUM

CISA KEV No

Public POC No

EPSS 0.1%

Patch available No

Active threat No

Deciding rule

MEDIUM severity (CVSS 4.0-6.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived

Scheduled

Exploitation

None

System Exposure· derived

Open

Automatable

Human Impact· derived

High

Technical Impact

Partial

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +32

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Memory Corruption HIGH

Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.