Mozilla Firefox CVE-2026-100800

Exploitation requires the victim to open attacker-controlled web content in a vulnerable Firefox (before 157, or ESR before 153.4) that exercises the Disability Access (accessibility) APIs to trigger the use-after-free - this is the UI:R limiting factor, so it is not zero-click or self-propagating. No authentication is needed (PR:N) and it works over the network against default configurations, but success depends on winning the UAF race and driving the freed accessibility object's reuse, then leveraging the resulting corruption to break out of the content sandbox (S:C). Patched builds (Firefox 157 / ESR 153.4) fully remove the condition.

This is the highest-severity member of the Firefox 157 / ESR 153.4 use-after-free cluster: CVSS 9.6 with vector AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H. The S:C (scope change) is the discriminator versus the 8.8 sibling UAFs (CVE-2026-100768/100774/100776 etc.) - this bug is a full SANDBOX ESCAPE out of the content process, so a compromise crosses a trust boundary into the host, which is why NVD/Mozilla rate it 9.6 rather than 8.8. However, the exploitation-likelihood signals are weak: EPSS is not provided, the CVE is NOT in CISA KEV, no public POC is referenced, and Mozilla's own SSVC posture for this advisory batch is exploitation:none. So while technical impact is severe (memory corruption + sandbox escape, C/I/A all High), there is no evidence of real-world exploitation - treat as a genuine but non-emergency priority driven by product ubiquity, not active-threat pressure. Two caveats to state explicitly: the vector correctly requires UI:R (victim must open a crafted page), so this is not a wormable zero-click issue; and the 'Information Disclosure' tag understates the flaw - this is memory corruption / sandbox escape, RCE-class, not a read-only leak.

An attacker lures a Firefox user (below 157 / ESR 153.4) to a malicious or compromised web page that triggers a use-after-free in the accessibility (Disability Access) APIs. The freed-then-reused object lets the attacker corrupt memory in the content process and, because of the scope change, escape the sandbox to gain code execution on the host. No public exploit code is identified at time of analysis, and the attack requires the victim to visit the page (UI:R).