Skip to main content

Mozilla Firefox EUVDEUVD-2026-88924

| CVE-2026-100772 HIGH
Use After Free (CWE-416)
2026-09-29 mozilla GHSA-w83r-p2vc-2rvf
Information Disclosure Use After Free Memory Corruption Red Hat Mozilla Firefox
8.8
CVSS 3.1 · Vendor: mozilla
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Host malicious web page
  2. Delivery
    Victim visits page in Firefox
  3. Exploit
    Trigger DOM use-after-free
  4. Execution
    Corrupt heap memory
  5. Impact
    Execute code in content process

Vulnerability Assessment

Weakness
CWE
CWE-416
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK

2 techniques across 2 tactics: Execution, Privilege Escalation

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Exploitation Conditions

Exploitation requires the victim to load attacker-controlled web content in Firefox (UI:R) - e.g., visiting a malicious site or rendering hostile HTML/DOM structures that trigger the use-after-free in the DOM Core & HTML component. No authentication or special configuration is needed (PR:N), and it works against default Firefox installations, but the mandatory user interaction (browsing to the content) is the primary limiting factor. Affected builds are those prior to Firefox 157, ESR 153.4, and ESR 140.17; systems on those patched versions are not exploitable.
Impact

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) describes a network-reachable, low-complexity, unauthenticated flaw requiring only user interaction - the classic browser drive-by profile: a victim visits a malicious web page. As a use-after-free in the DOM Core & HTML component (CWE-416), it is a memory-corruption primitive that in modern browser exploitation typically underpins arbitrary code execution within the content process, consistent with the H/H/H impact rating. No EPSS score, no CISA KEV listing, and no public POC were provided, so the classification is 'no public exploit identified at time of analysis' - this is NOT confirmed active exploitation. That said, Firefox UAF bugs in DOM are historically high-value and sometimes exploited; the absence of EPSS/KEV data here reflects missing signals rather than proven low risk. Given Firefox's enormous install base and the fully remote drive-by nature, this warrants prompt patching despite no exploitation evidence yet. One caveat: the input Tags label this 'Information Disclosure,' which understates the vector - I:H and A:H indicate integrity and availability impact beyond mere disclosure, so treat it as a memory-corruption/potential-RCE issue.
Exploit ScenarioDerived

An attacker hosts a malicious web page (or injects malicious content into an ad/iframe on a compromised legitimate site) and lures a Firefox user to visit it. The page triggers the use-after-free in the DOM Core & HTML engine, corrupting memory to achieve code execution within the browser content process. No public exploit code was identified at time of analysis, and exploitation requires the victim to actively load the attacker's content (UI:R).
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
No patch listed yet 0.3% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Sep 29, 2026

Use-after-free in Mozilla Firefox's DOM: Core & HTML component (CWE-416) lets remote attackers achieve full confidentiality and integrity impact against unpatched Firefox builds when a victim simply loads attacker-controlled web content, matching the CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). Affected are Firefox versions prior to 157, Firefox ESR prior to 153.4, and Firefox ESR prior to 140.17; exploitation needs no authentication or non-default configuration, and the mandatory browsing/user interaction is the primary limiting factor. No public exploit code was identified at time of analysis and there is no confirmed active exploitation (no CISA KEV listing), but Mozilla has shipped fixed builds, so prioritization should focus on unpatched endpoints in browser-exposed or high-value user populations.

RemediationAI

Vendor-released patch: upgrade to Firefox 157, Firefox ESR 153.4, or Firefox ESR 140.17 as applicable, which are the exact fixed versions noted for this CVE; enterprise administrators should force an update check or push the patched build through their management tooling, since users on unpatched builds continue to be exposed the moment they load hostile content. Patch details and per-train specifics are in Mozilla's security advisories mfsa2026-100, mfsa2026-99, and mfsa2026-97 (https://www.mozilla.org/security/advisories/mfsa2026-100/, https://www.mozilla.org/security/advisories/mfsa2026-99/, https://www.mozilla.org/security/advisories/mfsa2026-97/), with the technical root cause at https://bugzilla.mozilla.org/show_bug.cgi?id=2068340. If immediate upgrade is impossible, the most effective compensating control is to block browsing to untrusted sites from the vulnerable profile - for example, force-list only approved domains via enterprise policy or route general browsing through a hardened, patched alternative browser - because the trigger is attacker-supplied HTML/DOM content and no configuration change removes the underlying memory bug; the trade-off is severely reduced browsing utility. Disabling JavaScript (javascript.enabled=false in about:config, or a policy-enforced equivalent such as a NoScript-style extension) raises the bar against script-driven DOM manipulation, but because the flaw sits in DOM Core & HTML it may still be reachable through HTML parsing and layout paths without script execution, so this is only a partial mitigation and it breaks a large share of legitimate web applications. Additional hardening with a real cost-benefit trade-off: confine vulnerable Firefox instances to sandboxed or virtualized environments with no access to credentials or sensitive data, and monitor endpoint telemetry for Firefox crash or memory-corruption indicators that could signal attempted exploitation, accepting that such monitoring detects rather than prevents compromise.

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

The DOM: Core & HTML component is the Gecko engine subsystem that implements the Document Object Model used by Firefox, translating parsed HTML into live DOM objects that scripts and layout can traverse. The root-cause class here is CWE-416 (use-after-free): a DOM-related object is released while a reference to it remains reachable, so subsequent access to that stale pointer reads or writes freed memory - a primitive classically chained into arbitrary code execution or sensitive memory disclosure, which is consistent with the reported tags of Use After Free, Memory Corruption, and Information Disclosure and with the high C/H/I ratings in the CVSS vector. The provided CPE string (cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*) uses a wildcard version, meaning CPE alone does not narrow scope; version-based triage against the fixed releases is required. Attack prerequisites follow directly from the assessed vector: AV:N with PR:N means no credentials are needed, AC:L means no race or unusual timing, and UI:R means the trigger is the victim rendering hostile HTML/DOM structures, i.e., the classic drive-by browsing profile. Memory-safety bugs of this class are also more likely to be exploitable across platform builds because they do not depend on a configuration flag being enabled.

Know when Firefox gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (mozilla) PRIMARY 8.8 HIGH
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
vuln.today AI 8.8 HIGH

Remote drive-by against default Firefox with only user interaction to visit a page (AV:N/PR:N/UI:R); DOM use-after-free yields content-process code execution, giving full C/I/A impact.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE MEDIUM
Red Hat 7.5 HIGH

Primary rating from Vendor (mozilla).

CVSS VectorVendor: mozilla

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

3
CVSS changed
Sep 29, 2026 - 15:22 NVD
8.8 (HIGH)
CVE Published
Sep 29, 2026 - 12:36 cve.org
HIGH 8.8
CVE Published
Sep 29, 2026 - 12:36 cve.org
UNKNOWN (no severity yet)

DescriptionCVE.org

Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox ESR 153.4, Firefox 157, and Firefox ESR 140.17.

Executive ViewAI

Why It Matters

A use-after-free flaw in Mozilla Firefox's DOM engine (CVE-2026-100772, CVSS 8.8) allows any attacker-controlled website to compromise the confidentiality and integrity of a browsing session, requiring only that a user visit a malicious or compromised page. Because Firefox is broadly deployed across the workforce and is often the default browser on non-managed endpoints, leadership should treat this as a high-priority remediation item for the general user population, with the greatest exposure among users who routinely browse external or untrusted content.

Business Impact: High
Compensating Controls

Apply vendor patch - upgrade to Firefox 157, Firefox ESR 153.4, or Firefox ESR 140.17.

Threat Intelligence Overview

EPSS Score
0.3%
Top 76% exploitable
Prevalence
Ubiquitous
Firefox is one of the most widely deployed web browsers worldwide
Data Quality
7 sources
Confidence: High
EUVD 🇯🇵JVN NVD CVE.org EPSS Vulnrichment Vendor VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.3%
Patch available No
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision
Scheduled
Exploitation
None
System Exposure· derived
Open
Automatable
No
Human Impact
High
Technical Impact
Total

Priority Score

44
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +44
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Use After Free HIGH

Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.

Memory Corruption HIGH

Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.

Affected Products (CPE)CVE.org

cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*

More in Firefox

View all
CVE-2013-0758 CRITICAL POC
9.3 Jan 13

Mozilla Firefox before 18.0, Firefox ESR 10.x before 10.0.12 and 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderb
CVE-2013-0753 CRITICAL POC
9.3 Jan 13

Use-after-free vulnerability in the serializeToStream implementation in the XMLSerializer component in Mozilla Firefox b
CVE-2012-3993 CRITICAL POC
9.3 Oct 10

The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbi
CVE-2013-1710 CRITICAL POC
10.0 Aug 07

The crypto.generateCRMFRequest function in Mozilla Firefox before 23.0, Firefox ESR 17.x before 17.0.8, Thunderbird befo
CVE-2014-8636 HIGH POC
7.5 Jan 14

The XrayWrapper implementation in Mozilla Firefox before 35.0 and SeaMonkey before 2.32 does not properly interact with

CVE-2013-0757 CRITICAL POC
9.3 Jan 13

The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 18.0, Firefox ESR 17.x before 17.0.2, Thunderbi
CVE-2014-1510 CRITICAL POC
9.8 Mar 19

The Web IDL implementation in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and Se
CVE-2014-1511 CRITICAL POC
9.8 Mar 19

Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and SeaMonkey before 2.25 allow remo
CVE-2016-1960 HIGH POC
8.8 Mar 13

Integer underflow in the nsHtml5TreeBuilder class in the HTML5 string parser in Mozilla Firefox before 45.0 and Firefox

CVE-2015-0816 MEDIUM POC
5.0 Apr 01

Mozilla Firefox before 37.0, Firefox ESR 31.x before 31.6, and Thunderbird before 31.6 do not properly restrict resource
CVE-2015-0802 MEDIUM POC
5.0 Apr 01

Mozilla Firefox before 37.0 relies on docshell type information instead of page principal information for Window.webidl

CVE-2013-2566 MEDIUM POC
5.9 Mar 15

The RC4 algorithm, as used in the TLS protocol and SSL protocol, has many single-byte biases, which makes it easier for

Same weakness CWE-416 – Use After Free

View all
CVE-2019-0708 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2014-0322 HIGH POC
8.8
CVE-2012-4792 HIGH POC
8.8
CVE-2009-4324 HIGH POC
7.8
CVE-2015-0313 CRITICAL POC
9.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2013-2551 HIGH POC
8.8

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2025-68613 HIGH POC
8.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Module for Desktop Applications 15 SP7 Affected
SUSE Linux Enterprise Module for Package Hub 15 SP7 Affected
SUSE Linux Enterprise Server 15 SP7 Affected

References

Advisories & patches
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-100772 ADVISORY https://vuldb.com/vuln/411339 REF https://bugzilla.mozilla.org/show_bug.cgi?id=2068340 REF https://www.mozilla.org/security/advisories/mfsa2026-100/ REF https://www.mozilla.org/security/advisories/mfsa2026-101/ REF https://www.mozilla.org/security/advisories/mfsa2026-102/ REF https://www.mozilla.org/security/advisories/mfsa2026-103/ REF https://www.mozilla.org/security/advisories/mfsa2026-97/ REF https://www.mozilla.org/security/advisories/mfsa2026-99/

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy