Skip to main content

Mozilla Firefox CVE-2026-100814

| EUVDEUVD-2026-88793 HIGH
Buffer Overflow (CWE-119)
2026-09-29 mozilla GHSA-jqcr-9p6m-338j
Buffer Overflow Red Hat Mozilla Firefox
8.8
CVSS 3.1 · Vendor: mozilla
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Lure victim to malicious web page
  2. Delivery
    Deliver crafted JavaScript to JIT compiler
  3. Exploit
    Trigger incorrect boundary condition (OOB access)
  4. Execution
    Corrupt content-process memory
  5. Impact
    Execute code in browser sandbox

Vulnerability Assessment

Weakness
CWE
CWE-119
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, buffer size validation
MITRE ATT&CK

2 techniques across 2 tactics: Execution, Privilege Escalation

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Exploitation Conditions

Exploitation requires a victim using an affected Firefox (before 157) or Firefox ESR (before 153.4) to load attacker-controlled web content that executes JavaScript through the JIT engine - JIT compilation is on by default, so no special configuration is needed on the victim side. The limiting factor is user interaction (UI:R): the victim must visit or be redirected to the malicious page. Because scope is unchanged (S:U), impact is initially confined to the browser content process; escaping to the host requires chaining a separate sandbox-escape vulnerability. No authentication is required (PR:N).
Impact

This is a genuine near-critical browser flaw in the SpiderMonkey JavaScript JIT engine - historically the highest-value Firefox attack surface for reliable RCE, since JIT boundary/type-confusion bugs give attackers precise control over memory. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, 8.8) shows a network-reachable, low-complexity, unauthenticated bug requiring only that a victim visit a malicious page (UI:R). No EPSS score, KEV listing, or POC is provided in the input, and the report is a Mozilla self-disclosure, so all exploitation signals currently point to 'no confirmed exploitation.' The 8.8 reflects impact-and-reachability potential, not observed activity - this is a patch-promptly item rather than a drop-everything emergency. Note S:U (scope unchanged) means this alone does not escape the content sandbox; full host compromise would typically require chaining with a separate sandbox-escape bug (cf. the UAF sandbox-escape siblings CVE-2026-100800/100804 in the same batch). CWE-119 (generic memory corruption) with 'incorrect boundary conditions' plus the C/I/A:H triad is consistent with an out-of-bounds read/write in JIT-generated code.
Exploit ScenarioDerived

An attacker hosts or injects (via malvertising/compromised site) a web page containing JavaScript crafted to trip the JIT compiler's incorrect boundary condition, producing an out-of-bounds access in JIT-generated code. When a victim running an unpatched Firefox/ESR simply loads the page (UI:R), the attacker corrupts memory in the content process to gain code execution within the browser sandbox. No public exploit code is identified at time of analysis; a sandbox escape would need to be chained for full host takeover.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
No patch listed yet 0.3% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Sep 29, 2026

Remote code execution in Mozilla Firefox's SpiderMonkey JavaScript JIT engine allows unauthenticated attackers to corrupt memory via crafted web content, potentially leading to arbitrary code execution within the browser's content process. Exploitation requires the victim to visit or be redirected to a malicious page (UI:R) that triggers incorrect boundary conditions during JIT compilation; JIT is enabled by default, so no special victim configuration is needed. No public exploit code or active exploitation has been identified at time of analysis, but the flaw is near-critical due to the high-value JIT attack surface. Fixed in Firefox 157 and Firefox ESR 153.4.

RemediationAI

Apply the vendor-released patches by upgrading to Firefox 157 or Firefox ESR 153.4. Desktop users should use the browser's built-in updater or download the latest version from Mozilla; ESR administrators should update to 153.4 or later across managed endpoints. No specific workaround is documented, but as a temporary compensating control with performance trade-offs, users can disable JIT compilation via about:config by setting javascript.options.ion and javascript.options.baselinejit to false - this reduces attack surface for JIT-related bugs but significantly degrades JavaScript performance. Because exploitation requires user interaction, avoid visiting untrusted sites or clicking suspicious links until patched. For full technical details, consult Mozilla advisories mfsa2026-100 and mfsa2026-97 and Bugzilla bug 2068385.

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

The vulnerability resides in the JavaScript Engine: JIT component of Mozilla's SpiderMonkey engine, which compiles JavaScript to native machine code for performance. CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer) indicates that incorrect boundary conditions during JIT compilation or optimization allow memory corruption, a class of bug historically favored by attackers for precise control over memory layout. The CVSS vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H reflects that an unauthenticated remote attacker can achieve high confidentiality, integrity, and availability impact, but only with user interaction and without scope change - meaning the initial compromise is confined to the browser content process and a separate sandbox escape would be required to affect the host. The affected CPE (cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*) covers all Firefox versions prior to the fixes, and the flaw was reported by Mozilla, as documented in Bugzilla 2068385 and advisories mfsa2026-100 and mfsa2026-97.

Know when Firefox gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (mozilla) PRIMARY 8.8 HIGH
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
vuln.today AI 8.8 HIGH

Network-delivered malicious JS with no auth (PR:N) but requiring a page visit (UI:R); JIT memory corruption yields RCE-class C/I/A:H, sandbox keeps scope unchanged (S:U).

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE MEDIUM
Red Hat 6.1 MEDIUM

Primary rating from Vendor (mozilla).

CVSS VectorVendor: mozilla

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

3
CVSS changed
Sep 29, 2026 - 15:22 NVD
8.8 (HIGH)
CVE Published
Sep 29, 2026 - 12:36 cve.org
HIGH 8.8
CVE Published
Sep 29, 2026 - 12:36 cve.org
UNKNOWN (no severity yet)

DescriptionCVE.org

Incorrect boundary conditions in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox ESR 153.4 and Firefox 157.

Executive ViewAI

Why It Matters

Mozilla Firefox users are at risk from a high-severity remote code execution vulnerability (CVE-2026-100814) in the SpiderMonkey JavaScript engine. An attacker could exploit this by luring a user to a malicious website, potentially allowing arbitrary code execution on the affected system. With Firefox widely deployed across the organization, this poses a significant risk of endpoint compromise and data breach, warranting immediate attention.

Business Impact: High
Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

EPSS Score
0.3%
Top 85% exploitable
Prevalence
Ubiquitous
Firefox is one of the most widely deployed desktop browsers globally
Data Quality
7 sources
Confidence: High
EUVD 🇯🇵JVN NVD CVE.org EPSS Vulnrichment Vendor VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.3%
Patch available No
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision
Scheduled
Exploitation
None
System Exposure· derived
Open
Automatable
No
Human Impact
High
Technical Impact
Total

Priority Score

44
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +44
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Buffer Overflow HIGH

A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.

Affected Products (CPE)CVE.org

cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*

More in Firefox

View all
CVE-2013-0758 CRITICAL POC
9.3 Jan 13

Mozilla Firefox before 18.0, Firefox ESR 10.x before 10.0.12 and 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderb
CVE-2013-0753 CRITICAL POC
9.3 Jan 13

Use-after-free vulnerability in the serializeToStream implementation in the XMLSerializer component in Mozilla Firefox b
CVE-2012-3993 CRITICAL POC
9.3 Oct 10

The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbi
CVE-2013-1710 CRITICAL POC
10.0 Aug 07

The crypto.generateCRMFRequest function in Mozilla Firefox before 23.0, Firefox ESR 17.x before 17.0.8, Thunderbird befo
CVE-2014-8636 HIGH POC
7.5 Jan 14

The XrayWrapper implementation in Mozilla Firefox before 35.0 and SeaMonkey before 2.32 does not properly interact with

CVE-2013-0757 CRITICAL POC
9.3 Jan 13

The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 18.0, Firefox ESR 17.x before 17.0.2, Thunderbi
CVE-2014-1510 CRITICAL POC
9.8 Mar 19

The Web IDL implementation in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and Se
CVE-2014-1511 CRITICAL POC
9.8 Mar 19

Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and SeaMonkey before 2.25 allow remo
CVE-2016-1960 HIGH POC
8.8 Mar 13

Integer underflow in the nsHtml5TreeBuilder class in the HTML5 string parser in Mozilla Firefox before 45.0 and Firefox

CVE-2015-0816 MEDIUM POC
5.0 Apr 01

Mozilla Firefox before 37.0, Firefox ESR 31.x before 31.6, and Thunderbird before 31.6 do not properly restrict resource
CVE-2015-0802 MEDIUM POC
5.0 Apr 01

Mozilla Firefox before 37.0 relies on docshell type information instead of page principal information for Window.webidl

CVE-2013-2566 MEDIUM POC
5.9 Mar 15

The RC4 algorithm, as used in the TLS protocol and SSL protocol, has many single-byte biases, which makes it easier for

Same weakness CWE-119 – Buffer Overflow

View all
CVE-2020-0796 CRITICAL POC
10.0
CVE-2017-11882 HIGH POC
7.8
CVE-2014-6332 HIGH POC
8.8
CVE-2015-2426 HIGH POC
8.8
CVE-2013-3918 HIGH POC
8.8
CVE-2023-4966 HIGH POC
7.5
CVE-2017-11774 HIGH POC
7.8
CVE-2013-3660 HIGH POC
7.8

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2019-11043 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Module for Desktop Applications 15 SP7 Affected
SUSE Linux Enterprise Module for Package Hub 15 SP7 Affected
SUSE Linux Enterprise Server 15 SP7 Affected

References

Advisories & patches
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-100814 ADVISORY https://vuldb.com/vuln/411386 REF https://bugzilla.mozilla.org/show_bug.cgi?id=2068385 REF https://www.mozilla.org/security/advisories/mfsa2026-100/ REF https://www.mozilla.org/security/advisories/mfsa2026-101/ REF https://www.mozilla.org/security/advisories/mfsa2026-103/ REF https://www.mozilla.org/security/advisories/mfsa2026-97/

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy