Skip to main content

Mozilla Firefox CVE-2026-100819

| EUVDEUVD-2026-88798 CRITICAL
Buffer Overflow (CWE-119)
2026-09-29 mozilla GHSA-2x4q-w8v4-vwxh
Buffer Overflow Red Hat Mozilla Firefox
Critical
Disputed · 9.6 Vendor: mozilla
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Victim visits attacker-controlled page
  2. Delivery
    Malicious content triggers XPCOM boundary error
  3. Exploit
    Corrupt memory in content process
  4. Execution
    Escape sandbox to host (S:C)
  5. Impact
    Execute code with full C/I/A impact

Vulnerability Assessment

Weakness
CWE
CWE-119
MITRE ATT&CK

2 techniques across 2 tactics: Execution, Privilege Escalation

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Exploitation Conditions

Exploitation requires the victim to load attacker-controlled web content in Firefox (UI:R) - the flaw is triggered through the XPCOM component during normal browsing of a malicious or compromised page; no authentication or special privileges are needed (PR:N). The primary limiting factor is required user interaction (visiting/rendering the crafted content) and that the user runs an unpatched version below Firefox 157 / ESR 153.4 / ESR 140.17 / ESR 115.42. No non-default configuration is indicated. The distinguishing severity factor is that a successful trigger escapes the browser sandbox (S:C), affecting the host beyond the content process.
Impact

This is a genuinely high-severity issue whose signals are internally consistent but point to potential-not-active risk. The CVSS 9.6 is driven by the S:C (scope change) metric - a content-process compromise that escapes the Firefox sandbox to affect the host system - combined with network vector, low complexity, no privileges, and full C:H/I:H/A:H impact. The only mitigating base metric is UI:R (the victim must load attacker content). Against this, the exploitation signals are cool: SSVC reports Exploitation:none and Automatable:no (browser bugs require victim interaction, so they don't self-propagate), while Technical Impact:total aligns with the sandbox-escape severity. There is no EPSS score, no CISA KEV listing, and no public POC - consistent with a Mozilla self-reported, coordinated-disclosure batch fix rather than in-the-wild abuse. Net: a real priority to patch because a sandbox escape defeats Firefox's primary containment boundary, but current evidence indicates no known exploitation. The 9.6 reflects worst-case impact, not demonstrated attacker activity.
Exploit ScenarioDerived

An attacker hosts a malicious web page (or injects malicious content into a page the victim visits) that triggers the XPCOM boundary-condition flaw. Because the scope changes (S:C), a successful trigger lets attacker-controlled code break out of the content sandbox and act on the host with full impact. No public exploit code has been identified at time of analysis, and exploitation requires the victim to load the crafted content (UI:R).
Act Now Prioritize within 24-48h. Why: CRITICAL severity.
No patch listed yet 0.3% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Sep 29, 2026

Sandbox escape in Mozilla Firefox stems from improper boundary checks in the XPCOM component, allowing remote attackers to break out of the browser's content sandbox and compromise the host when a victim loads attacker-controlled web content. The flaw carries a CVSS 9.6 with required user interaction (UI:R) and no authentication (PR:N), affecting unpatched versions below Firefox 157, Firefox ESR 153.4, Firefox ESR 140.17, and Firefox ESR 115.42. No public exploit identified at time of analysis, and CISA SSVC records Exploitation: none, so this is a high-severity patching priority rather than a confirmed active threat.

RemediationAI

Apply the vendor-released fixes: upgrade to Firefox 157, Firefox ESR 153.4, Firefox ESR 140.17, or Firefox ESR 115.42; these versions correspond to the Mozilla advisories mfsa2026-97 through mfsa2026-100 and the Bugzilla issue 2071069. No vendor-released patch identified for versions outside those fixed branches, so administrators should prioritize updating affected ESR deployments and standard Firefox installations. If immediate patching is not possible, restrict browsing to trusted content, use a separate unprivileged OS account or sandboxed virtual machine to reduce host impact from a browser sandbox escape, and consider disabling JavaScript or using a content blocker as partial attack-surface reduction; these compensating controls have usability trade-offs and do not remediate the underlying XPCOM boundary-condition flaw. No public exploit identified at time of analysis, but the CVSS 9.6 score and S:C sandbox-escape impact justify treating this as a high-priority patch cycle.

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

The vulnerability is a memory-safety boundary-condition error in Mozilla's XPCOM (Cross-Platform Component Object Model), the component framework used throughout Firefox for inter-module communication and privileged operations. CWE-119 (improper restriction of operations within the bounds of a memory buffer) and the Buffer Overflow tag indicate that insufficient bounds checking can lead to memory corruption inside an XPCOM component; because the CVSS vector includes S:C (scope changed), a successful trigger escapes the browser's content sandbox and affects resources beyond the content process. The vector AV:N/AC:L/PR:N/UI:R means exploitation is network-reachable, low-complexity, requires no privileges, but requires the victim to load crafted web content; CPE cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:* confirms the affected product family, with fixes in Firefox 157 and the ESR branches 153.4, 140.17, and 115.42.

Know when Firefox gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Sources disagree (Medium–Critical)
Vendor (mozilla) PRIMARY 9.6 CRITICAL
AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
vuln.today AI 9.6 CRITICAL

Remote crafted content requires victim interaction (UI:R) but no auth (PR:N); sandbox escape crosses the security boundary (S:C) yielding full host C/I/A impact.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
SUSE MEDIUM
Red Hat 6.1 MEDIUM

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: mozilla

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Changed
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

2
CVE Published
Sep 29, 2026 - 12:36 cve.org
CRITICAL 9.6
CVE Published
Sep 29, 2026 - 12:36 cve.org
UNKNOWN (no severity yet)

DescriptionCVE.org

Sandbox escape due to incorrect boundary conditions in the XPCOM component. This vulnerability was fixed in Firefox ESR 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.

Executive ViewAI

Why It Matters

Mozilla Firefox contains a critical sandbox escape (CVE-2026-100819) that can allow attacker-controlled web content to compromise the underlying host, putting enterprise endpoints and data beyond the browser at risk. The issue is unauthenticated but requires user interaction, so workforce browsing of malicious or compromised sites is the primary exposure path; leadership should treat it as a high-priority endpoint security and patching issue even though no public exploit has been identified at time of analysis.

Business Impact: Severe
Compensating Controls

No vendor-released patch identified at time of analysis. Interim mitigations: restrict browsing to trusted sites and block untrusted web content, isolate Firefox from sensitive systems, enforce application allowlisting, disable unnecessary browser extensions/plugins, and monitor for anomalous host activity; apply vendor patch when released.

Threat Intelligence Overview

EPSS Score
0.3%
Top 82% exploitable
Prevalence
Ubiquitous
Firefox is a globally deployed mainstream web browser
Data Quality
7 sources
Confidence: High
EUVD 🇯🇵JVN NVD CVE.org EPSS Vulnrichment Vendor VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity CRITICAL
CISA KEV No
Public POC No
EPSS 0.3%
Patch available No
Active threat No
Deciding rule
CRITICAL severity
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision
Scheduled
Exploitation
None
System Exposure· derived
Open
Automatable
No
Human Impact
Very High
Technical Impact
Total

Priority Score

48
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +48
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Buffer Overflow HIGH

A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.

Affected Products (CPE)CVE.org

cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*

More in Firefox

View all
CVE-2013-0758 CRITICAL POC
9.3 Jan 13

Mozilla Firefox before 18.0, Firefox ESR 10.x before 10.0.12 and 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderb
CVE-2013-0753 CRITICAL POC
9.3 Jan 13

Use-after-free vulnerability in the serializeToStream implementation in the XMLSerializer component in Mozilla Firefox b
CVE-2012-3993 CRITICAL POC
9.3 Oct 10

The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbi
CVE-2013-1710 CRITICAL POC
10.0 Aug 07

The crypto.generateCRMFRequest function in Mozilla Firefox before 23.0, Firefox ESR 17.x before 17.0.8, Thunderbird befo
CVE-2014-8636 HIGH POC
7.5 Jan 14

The XrayWrapper implementation in Mozilla Firefox before 35.0 and SeaMonkey before 2.32 does not properly interact with

CVE-2013-0757 CRITICAL POC
9.3 Jan 13

The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 18.0, Firefox ESR 17.x before 17.0.2, Thunderbi
CVE-2014-1510 CRITICAL POC
9.8 Mar 19

The Web IDL implementation in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and Se
CVE-2014-1511 CRITICAL POC
9.8 Mar 19

Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and SeaMonkey before 2.25 allow remo
CVE-2016-1960 HIGH POC
8.8 Mar 13

Integer underflow in the nsHtml5TreeBuilder class in the HTML5 string parser in Mozilla Firefox before 45.0 and Firefox

CVE-2015-0816 MEDIUM POC
5.0 Apr 01

Mozilla Firefox before 37.0, Firefox ESR 31.x before 31.6, and Thunderbird before 31.6 do not properly restrict resource
CVE-2015-0802 MEDIUM POC
5.0 Apr 01

Mozilla Firefox before 37.0 relies on docshell type information instead of page principal information for Window.webidl

CVE-2013-2566 MEDIUM POC
5.9 Mar 15

The RC4 algorithm, as used in the TLS protocol and SSL protocol, has many single-byte biases, which makes it easier for

Same weakness CWE-119 – Buffer Overflow

View all
CVE-2020-0796 CRITICAL POC
10.0
CVE-2017-11882 HIGH POC
7.8
CVE-2014-6332 HIGH POC
8.8
CVE-2015-2426 HIGH POC
8.8
CVE-2013-3918 HIGH POC
8.8
CVE-2023-4966 HIGH POC
7.5
CVE-2017-11774 HIGH POC
7.8
CVE-2013-3660 HIGH POC
7.8

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2019-11043 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Module for Desktop Applications 15 SP7 Affected
SUSE Linux Enterprise Module for Package Hub 15 SP7 Affected
SUSE Linux Enterprise Server 15 SP7 Affected

References

Advisories & patches
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-100819 ADVISORY https://vuldb.com/vuln/411392 REF https://bugzilla.mozilla.org/show_bug.cgi?id=2071069 REF https://www.mozilla.org/security/advisories/mfsa2026-100/ REF https://www.mozilla.org/security/advisories/mfsa2026-101/ REF https://www.mozilla.org/security/advisories/mfsa2026-102/ REF https://www.mozilla.org/security/advisories/mfsa2026-103/ REF https://www.mozilla.org/security/advisories/mfsa2026-97/ REF https://www.mozilla.org/security/advisories/mfsa2026-98/ REF https://www.mozilla.org/security/advisories/mfsa2026-99/

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy