Skip to main content

Mozilla Firefox EUVDEUVD-2026-88914

| CVE-2026-100762 CRITICAL
Use After Free (CWE-416)
2026-09-29 mozilla GHSA-h88x-j33p-gqc3
Information Disclosure Use After Free Memory Corruption Red Hat Mozilla Firefox
9.6
CVSS 3.1 · Vendor: mozilla
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Lure victim to malicious web page
  2. Delivery
    Serve crafted DOM/content-process payload
  3. Exploit
    Trigger use-after-free in Content Processes
  4. Execution
    Groom heap and hijack execution
  5. Persist
    Escape content sandbox to parent process
  6. Impact
    Achieve code execution on host

Vulnerability Assessment

Weakness
CWE
CWE-416
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK

2 techniques across 2 tactics: Execution, Privilege Escalation

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Exploitation Conditions

Exploitation requires a victim using an unpatched Firefox/Firefox ESR build (before 157 / ESR 153.4 / ESR 140.17 / ESR 115.42) to visit or render attacker-controlled web content that triggers the use-after-free in the DOM Content Processes code - this is the UI:R requirement and the primary limiting factor. No authentication or elevated privileges are needed (PR:N), and it works against default configurations. The practical limiters are: mandatory user interaction (loading the malicious page), the inherent difficulty of reliably grooming a UAF for a sandbox escape, and the fact that patched or auto-updated browsers are unaffected.
Impact

This is a genuine high-priority browser vulnerability, though not an emergency. The CVSS 9.6 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H) is driven by the scope change (S:C) - a use-after-free in the DOM Content Processes component that enables a SANDBOX ESCAPE, letting attacker-controlled content-process code break out and affect the more-privileged parent process/host, hence C:H/I:H/A:H and the elevation above the 8.8 same-scope UAFs in the same batch. Attack vector is network (a malicious web page) with low complexity but requiring user interaction (UI:R - victim must visit the page). Weighing the signals: EPSS is not provided, there is NO CISA KEV listing, and NO public POC is referenced - Mozilla self-reported this via MFSA advisories, and SSVC-style exploitation status is effectively 'none.' So while the technical impact is severe (RCE-class sandbox escape), there is no evidence of real-world exploitation or available exploit code at time of analysis. The realistic risk is 'patch promptly on the normal browser-update cadence' rather than 'exploited zero-day.' UAF memory-corruption bugs are non-trivial to weaponize reliably, which tempers immediate risk absent a POC.
Exploit ScenarioDerived

An attacker hosts a malicious web page that manipulates DOM objects in a Firefox content process to trigger the use-after-free, then grooms the freed allocation to gain control of execution and escape the content-process sandbox into the parent process. The victim need only visit the page (UI:R). No public exploit code or active exploitation is identified at time of analysis.
Act Now Prioritize within 24-48h. Why: CRITICAL severity.
No patch listed yet 0.3% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Sep 29, 2026

A use-after-free in Firefox's DOM Content Processes component lets unauthenticated remote attackers escape the content-process sandbox by getting a victim to render attacker-controlled web content, resulting in high confidentiality, integrity and availability impact across a changed security scope (CVSS 9.6, AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H). The mandatory user interaction (loading or rendering the malicious page) is the primary limiting factor, and no authentication or elevated privileges are required. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the issue is fixed in Firefox 157, Firefox ESR 153.4, Firefox ESR 140.17 and Firefox ESR 115.42, so patched or auto-updated installations are unaffected.

RemediationAI

Apply the vendor-released patch: upgrade to Firefox 157, or to Firefox ESR 153.4, Firefox ESR 140.17, or Firefox ESR 115.42 depending on the channel in use; these are the exact fixed versions named in the Mozilla security advisories (https://www.mozilla.org/security/advisories/mfsa2026-97/, /mfsa2026-98/, /mfsa2026-99/, /mfsa2026-100/), with the technical detail in https://bugzilla.mozilla.org/show_bug.cgi?id=2059404. Ensure automatic updates are enabled and verify the running build via about:support, since ESR users on pinning or offline-managed fleets are the most likely to remain exposed. No vendor workaround is documented for this use-after-free; the practical compensating controls are to restrict browsing of untrusted or attacker-influenced content inside Firefox from high-value workstations and to isolate that browsing in a separate, disposable VM or a hardened OS-level sandbox - the trade-off being reduced usability and residual risk if the sandbox itself is weaker than Firefox's own. Disabling JavaScript or extensions is not a reliable mitigation for a DOM content-process bug and would break most sites, and blocking ports or endpoints is inapplicable because the attack surface is the browser rendering arbitrary web content; treat patching as the only dependable fix and prioritise it, given a CVSS of 9.6.

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

The vulnerability is a use-after-free (CWE-416), the classic memory-safety class in which an object is freed while a dangling reference to it remains, and subsequent reuse of that memory allows an attacker to control data structures and corrupt memory. This instance lives in Firefox's DOM handling inside the Content Processes component, the renderer sandbox that handles untrusted web content under Firefox's multi-process (Electrolysis/Fission) architecture; because the flaw yields a sandbox escape rather than simple renderer compromise, the CVSS scope is marked Changed (S:C), meaning impact crosses the intended security boundary into a more privileged process with full read/write/execute potential. The accompanying tags - memory corruption and information disclosure - are consistent with UAF exploitation patterns where leaked or sprayed heap data is used to shape the allocation before the freed object is reused. Exploitation is remote and unauthenticated in the sense of the assessed vector (PR:N) but requires user interaction (UI:R), i.e. a victim on an unpatched build must open or render attacker-supplied content; reliably grooming a use-after-free into a working sandbox escape is non-trivial, which is an important practical brake on weaponization even though the theoretical severity is high.

Know when Firefox gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (mozilla) PRIMARY 9.6 CRITICAL
AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
vuln.today AI 9.6 CRITICAL

Remote malicious page (AV:N, UI:R), no privileges (PR:N); content-process UAF escapes the sandbox to the parent process (S:C) yielding full C/I/A:H.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
SUSE CRITICAL
Red Hat 7.5 HIGH

Primary rating from Vendor (mozilla).

CVSS VectorVendor: mozilla

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Changed
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

3
CVSS changed
Sep 29, 2026 - 17:22 NVD
9.6 (CRITICAL)
CVE Published
Sep 29, 2026 - 12:35 cve.org
UNKNOWN (no severity yet)
CVE Published
Sep 29, 2026 - 12:35 cve.org
CRITICAL 9.6

DescriptionCVE.org

Sandbox escape due to use-after-free in the DOM: Content Processes component. This vulnerability was fixed in Firefox ESR 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.

Articles & Coverage 1

News Critical UAF Sandbox Escape in Mozilla Firefox - CVE-2026-100762 Sep 30, 2026

Executive ViewAI

Why It Matters

A critical memory-safety flaw in Mozilla Firefox's DOM Content Processes component allows a malicious web page to break out of the browser's sandbox and take control of the underlying endpoint, affecting any employee, contractor, or executive who browses the internet with an unpatched Firefox build. Because the attack requires no credentials and the only trigger is a user visiting attacker-controlled content, the exposure is broad and largely outside the control of network defenses, making browser patch currency the single most important control. Leadership should care because a successful exploit converts a routine web-browsing action into a full workstation compromise with high confidentiality, integrity, and availability impact, and Mozilla has already published fixed versions that close the gap.

Business Impact: High
Compensating Controls

Apply vendor patch. Where endpoints cannot be updated immediately, keep auto-update enabled and allow the browser to restart, restrict high-risk browsing and unsolicited links for affected users, enforce enterprise browser policies limiting script/extension exposure, and monitor browser child-process anomalies and outbound data flows as an interim detection measure.

Threat Intelligence Overview

EPSS Score
0.3%
Top 75% exploitable
Prevalence
Ubiquitous
Firefox is one of the most widely deployed desktop browsers worldwide
Data Quality
7 sources
Confidence: High
EUVD 🇯🇵JVN NVD CVE.org EPSS Vulnrichment Vendor VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity CRITICAL
CISA KEV No
Public POC No
EPSS 0.3%
Patch available No
Active threat No
Deciding rule
CRITICAL severity
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision
Scheduled
Exploitation
None
System Exposure· derived
Open
Automatable
No
Human Impact
High
Technical Impact
Total

Priority Score

48
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +48
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Use After Free HIGH

Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.

Memory Corruption HIGH

Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.

Affected Products (CPE)CVE.org

cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*

More in Firefox

View all
CVE-2013-0758 CRITICAL POC
9.3 Jan 13

Mozilla Firefox before 18.0, Firefox ESR 10.x before 10.0.12 and 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderb
CVE-2013-0753 CRITICAL POC
9.3 Jan 13

Use-after-free vulnerability in the serializeToStream implementation in the XMLSerializer component in Mozilla Firefox b
CVE-2012-3993 CRITICAL POC
9.3 Oct 10

The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbi
CVE-2013-1710 CRITICAL POC
10.0 Aug 07

The crypto.generateCRMFRequest function in Mozilla Firefox before 23.0, Firefox ESR 17.x before 17.0.8, Thunderbird befo
CVE-2014-8636 HIGH POC
7.5 Jan 14

The XrayWrapper implementation in Mozilla Firefox before 35.0 and SeaMonkey before 2.32 does not properly interact with

CVE-2013-0757 CRITICAL POC
9.3 Jan 13

The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 18.0, Firefox ESR 17.x before 17.0.2, Thunderbi
CVE-2014-1510 CRITICAL POC
9.8 Mar 19

The Web IDL implementation in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and Se
CVE-2014-1511 CRITICAL POC
9.8 Mar 19

Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and SeaMonkey before 2.25 allow remo
CVE-2016-1960 HIGH POC
8.8 Mar 13

Integer underflow in the nsHtml5TreeBuilder class in the HTML5 string parser in Mozilla Firefox before 45.0 and Firefox

CVE-2015-0816 MEDIUM POC
5.0 Apr 01

Mozilla Firefox before 37.0, Firefox ESR 31.x before 31.6, and Thunderbird before 31.6 do not properly restrict resource
CVE-2015-0802 MEDIUM POC
5.0 Apr 01

Mozilla Firefox before 37.0 relies on docshell type information instead of page principal information for Window.webidl

CVE-2013-2566 MEDIUM POC
5.9 Mar 15

The RC4 algorithm, as used in the TLS protocol and SSL protocol, has many single-byte biases, which makes it easier for

Same weakness CWE-416 – Use After Free

View all
CVE-2019-0708 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2014-0322 HIGH POC
8.8
CVE-2012-4792 HIGH POC
8.8
CVE-2009-4324 HIGH POC
7.8
CVE-2015-0313 CRITICAL POC
9.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2013-2551 HIGH POC
8.8

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2025-68613 HIGH POC
8.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5

Vendor StatusVendor

SUSE

Severity: Critical
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Module for Desktop Applications 15 SP7 Affected
SUSE Linux Enterprise Module for Package Hub 15 SP7 Affected
SUSE Linux Enterprise Server 15 SP7 Affected

References

Advisories & patches
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-100762 ADVISORY https://vuldb.com/vuln/411323 REF https://bugzilla.mozilla.org/show_bug.cgi?id=2059404 REF https://www.mozilla.org/security/advisories/mfsa2026-100/ REF https://www.mozilla.org/security/advisories/mfsa2026-101/ REF https://www.mozilla.org/security/advisories/mfsa2026-102/ REF https://www.mozilla.org/security/advisories/mfsa2026-103/ REF https://www.mozilla.org/security/advisories/mfsa2026-97/ REF https://www.mozilla.org/security/advisories/mfsa2026-98/ REF https://www.mozilla.org/security/advisories/mfsa2026-99/

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy