Skip to main content

Mozilla Firefox EUVDEUVD-2026-88917

| CVE-2026-100765 HIGH
Use After Free (CWE-416)
2026-09-29 mozilla GHSA-m4qr-cm5x-hhr7
Information Disclosure Use After Free Memory Corruption Mozilla Firefox Webassembly
8.8
CVSS 3.1 · Vendor: mozilla
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Lure victim to malicious web page
  2. Delivery
    Deliver crafted WebAssembly/JS payload
  3. Exploit
    Trigger use-after-free in WASM component
  4. Execution
    Corrupt content-process memory
  5. Impact
    Execute attacker code / disclose memory

Vulnerability Assessment

Weakness
CWE
CWE-416
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK

2 techniques across 2 tactics: Execution, Privilege Escalation

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Exploitation Conditions

Exploitation requires the victim to load attacker-controlled web content in an unpatched Firefox (before ESR 153.4 or 157) that exercises the JavaScript WebAssembly component; the victim must run WASM-executing content, satisfying UI:R. No authentication or special privileges are needed (PR:N), and default configurations are affected since WebAssembly is enabled by default. Limiting factors: it needs user interaction (navigating to or rendering the malicious page), and the content-process sandbox (S:U) constrains impact to the browser process absent a separate sandbox-escape bug.
Impact

This is a genuine high-priority browser vulnerability. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) describes a network-reachable, low-complexity, unauthenticated flaw requiring only user interaction (visiting a malicious page) with full C/I/A impact - the classic profile of a browser memory-corruption bug leading to code execution in the content process. CWE-416 use-after-free in the WebAssembly JIT/runtime is a well-understood and highly exploitable bug class historically weaponized against Firefox. However, exploitation-likelihood signals are absent from the input: no EPSS score, no CISA KEV listing, and no public POC are provided, so this is 'no public exploit identified at time of analysis' rather than confirmed active exploitation. The 8.8 score reflects worst-case technical impact, not observed exploitation; UI:R and modern browser sandboxing (a UAF in the content process still requires a sandbox escape for full host compromise, which S:U reflects) temper real-world severity somewhat. Net: patch promptly given the ubiquity of Firefox and the exploitability of WASM UAFs, but there is no evidence yet of in-the-wild use.
Exploit ScenarioDerived

An attacker hosts or compromises a web page containing malicious JavaScript/WebAssembly that triggers the use-after-free in Firefox's WASM component when a victim visits it. Successful exploitation corrupts memory in the content process, enabling arbitrary code execution or information disclosure within the browser sandbox. No public POC is referenced, and exploitation requires the victim to load attacker-controlled web content (UI:R).
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
No patch listed yet 0.3% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Sep 29, 2026

Use-after-free in Mozilla Firefox's JavaScript WebAssembly engine enables remote code execution or memory corruption when a victim views a malicious webpage, requiring only that the user loads attacker-controlled content (UI:R) with no authentication (PR:N). The flaw affects all Firefox versions prior to 157 and Firefox ESR prior to 153.4, and is rated CVSS 8.8 due to high confidentiality, integrity, and availability impact; the content-process sandbox (S:U) limits impact to the browser process absent a separate escape. No public exploit identified at time of analysis, and no CISA KEV listing; Mozilla has released patches in Firefox 157 and Firefox ESR 153.4.

RemediationAI

Upgrade to Firefox 157 or Firefox ESR 153.4 immediately; these versions contain the vendor-released patch. Mozilla's advisories mfsa2026-100 and mfsa2026-97 (linked from the references) provide the official upgrade guidance, and the underlying fix is documented in Bugzilla 2061399. If immediate patching is not possible, a compensating control is to disable WebAssembly by setting javascript.options.wasm to false in about:config; however, this will break legitimate websites and web applications that rely on WASM, and it must be reverted after patching. Additionally, running Firefox in a restricted environment or using a separate browser profile with JavaScript disabled for untrusted sites can reduce exposure, though these measures severely degrade browsing functionality. Do not rely on the content-process sandbox alone, as a use-after-free can still lead to code execution within that process. No other workarounds are documented by the vendor.

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

The vulnerability is a use-after-free (CWE-416) in the JavaScript: WebAssembly component of Mozilla Firefox. WebAssembly (WASM) is a binary instruction format that runs in a sandboxed virtual machine within the browser; Firefox's WASM engine includes JavaScript bindings that manage memory and object lifetimes. A use-after-free occurs when a memory object related to WASM compilation, instantiation, or garbage collection is freed but later dereferenced, allowing an attacker to corrupt memory and potentially achieve arbitrary code execution or information disclosure (as indicated by tags). The CPE string cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:* confirms all Firefox versions are potentially affected prior to the fixed releases. The independent assessment notes that WebAssembly is enabled by default in Firefox, making default configurations vulnerable; exploitation requires the victim to load attacker-controlled web content that exercises the WASM component, and the content-process sandbox (S:U) constrains the impact to the browser process unless combined with a sandbox-escape bug.

Know when Webassembly gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (mozilla) PRIMARY 8.8 HIGH
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
vuln.today AI 8.8 HIGH

Remote malicious web page (AV:N) requires only a victim visit (UI:R), no auth (PR:N); WASM UAF yields memory corruption with code-exec potential in the content process, so C/I/A:H and S:U.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE CRITICAL

Primary rating from Vendor (mozilla).

CVSS VectorVendor: mozilla

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

3
CVSS changed
Sep 29, 2026 - 15:22 NVD
8.8 (HIGH)
CVE Published
Sep 29, 2026 - 12:35 cve.org
HIGH 8.8
CVE Published
Sep 29, 2026 - 12:35 cve.org
UNKNOWN (no severity yet)

DescriptionCVE.org

Use-after-free in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox ESR 153.4 and Firefox 157.

Executive ViewAI

Why It Matters

A critical memory-corruption flaw in Mozilla Firefox's WebAssembly engine could let an attacker execute code on employee workstations simply by getting a user to open a malicious web page - no credentials or user privileges required. Because Firefox is widely deployed across the workforce for both business and personal browsing, any user with the browser installed is a potential entry point, and successful exploitation could expose data, allow tampering, or disrupt endpoint availability. Leadership should treat this as a broad, low-effort attack path against the general user population rather than a targeted threat.

Business Impact: High
Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

EPSS Score
0.3%
Top 78% exploitable
Prevalence
Ubiquitous
Firefox is a mainstream web browser deployed across consumer and enterprise environments worldwide
Data Quality
7 sources
Confidence: High
EUVD 🇯🇵JVN NVD CVE.org EPSS Vulnrichment Vendor VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.3%
Patch available No
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision
Scheduled
Exploitation
None
System Exposure· derived
Open
Automatable
No
Human Impact
High
Technical Impact
Total

Priority Score

44
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +44
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Use After Free HIGH

Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.

Memory Corruption HIGH

Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.

Affected Products (CPE)CVE.org

cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*

More in Webassembly

View all
CVE-2023-27117 HIGH POC
7.8 Mar 10

WebAssembly v1.0.29 was discovered to contain a heap overflow via the component component wabt::Node::operator. Rated hi
CVE-2022-43281 HIGH POC
7.8 Oct 28

wasm-interp v1.0.29 was discovered to contain a heap overflow via the component std::vector<wabt::Type, std::allocator<w
CVE-2023-31670 HIGH POC
7.5 May 23

An issue in wasm2c 1.0.32, wasm2wat 1.0.32, wasm-decompile 1.0.32, and wasm-validate 1.0.32 allows attackers to cause a

CVE-2021-45290 HIGH POC
7.5 Dec 21

A Denial of Service vulnerability exits in Binaryen 103 due to an assertion abort in wasm::handle_unreachable. Rated hig
CVE-2026-90648 HIGH POC
7.1 Sep 12

Sandbox escape in wasm2c (wabt ≤ 1.0.41) allows an attacker controlling WebAssembly content to achieve arbitrary read/wr
CVE-2022-43282 HIGH POC
7.1 Oct 28

wasm-interp v1.0.29 was discovered to contain an out-of-bounds read via the component OnReturnCallIndirectExpr->GetRetur
CVE-2022-43280 HIGH POC
7.1 Oct 28

wasm-interp v1.0.29 was discovered to contain an out-of-bounds read via the component OnReturnCallExpr->GetReturnCallDro
CVE-2019-15759 MEDIUM POC
6.5 Aug 29

An issue was discovered in Binaryen 1.38.32. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitabl
CVE-2019-15758 MEDIUM POC
6.5 Aug 29

An issue was discovered in Binaryen 1.38.32. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitabl
CVE-2019-7704 MEDIUM POC
6.5 Feb 10

wasm::WasmBinaryBuilder::readUserSection in wasm-binary.cpp in Binaryen 1.38.22 triggers an attempt at excessive memory

CVE-2019-7703 MEDIUM POC
6.5 Feb 10

In Binaryen 1.38.22, there is a use-after-free problem in wasm::WasmBinaryBuilder::visitCall in wasm-binary.cpp. Rated m
CVE-2019-7702 MEDIUM POC
6.5 Feb 10

A NULL pointer dereference was discovered in wasm::SExpressionWasmBuilder::parseExpression in wasm-s-parser.cpp in Binar

Same weakness CWE-416 – Use After Free

View all
CVE-2019-0708 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2014-0322 HIGH POC
8.8
CVE-2012-4792 HIGH POC
8.8
CVE-2009-4324 HIGH POC
7.8
CVE-2015-0313 CRITICAL POC
9.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2013-2551 HIGH POC
8.8

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2025-68613 HIGH POC
8.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5

Vendor StatusVendor

SUSE

Severity: Critical
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Module for Desktop Applications 15 SP7 Affected
SUSE Linux Enterprise Module for Package Hub 15 SP7 Affected
SUSE Linux Enterprise Server 15 SP7 Affected

References

Advisories & patches
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-100765 ADVISORY https://vuldb.com/vuln/411334 REF https://bugzilla.mozilla.org/show_bug.cgi?id=2061399 REF https://www.mozilla.org/security/advisories/mfsa2026-100/ REF https://www.mozilla.org/security/advisories/mfsa2026-101/ REF https://www.mozilla.org/security/advisories/mfsa2026-103/ REF https://www.mozilla.org/security/advisories/mfsa2026-97/

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy