Skip to main content

Mozilla Firefox EUVDEUVD-2026-88925

| CVE-2026-100773 HIGH
Use After Free (CWE-416)
2026-09-29 mozilla GHSA-rqvv-w7f6-cqh3
Information Disclosure Use After Free Memory Corruption Red Hat Mozilla Firefox
8.8
CVSS 3.1 · Vendor: mozilla
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Lure victim to malicious webpage
  2. Delivery
    Serve JavaScript exploiting IndexedDB
  3. Exploit
    Trigger use-after-free in storage engine
  4. Execution
    Reclaim and control freed memory
  5. Impact
    Achieve code execution in content process

Vulnerability Assessment

Weakness
CWE
CWE-416
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK

2 techniques across 2 tactics: Execution, Privilege Escalation

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Exploitation Conditions

Requires the victim to load attacker-controlled web content in Firefox (UI:R) that exercises the IndexedDB storage API to trigger the use-after-free; no authentication or special privileges are needed (PR:N). Exploitation is limited by the need for user interaction (visiting or being served the malicious page) and by targeting only versions prior to Firefox 157, ESR 153.4, ESR 140.17, and ESR 115.42 - patched builds are not affected. No non-default configuration is required; IndexedDB is a standard, enabled-by-default browser storage feature.
Impact

This is a genuine priority given the affected product's footprint, though not the highest tier of urgency. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, score 8.8) shows a network-reachable, low-complexity, unauthenticated flaw whose only gating factor is user interaction (UI:R) - the victim must load attacker-controlled web content. CWE-416 use-after-free in a browser's IndexedDB storage engine is a classic memory-corruption primitive that can escalate from crash to information disclosure to arbitrary code execution within the content process, which is why all three impact metrics are High. No EPSS score, no CISA KEV listing, and no public POC are present in the supplied intelligence, so there is no evidence of active exploitation - the risk is potential rather than demonstrated. Note the input Tags label this 'Information Disclosure,' which understates the issue: a UAF with C/I/A:H is memory corruption, not a read-only leak, so treat the CVSS impact profile as authoritative over the tag. Mozilla-reported and vendor-patched across multiple ESR trains, indicating a well-understood, responsibly-disclosed browser bug rather than a targeted 0-day.
Exploit ScenarioDerived

An attacker hosts a malicious webpage (or injects a malicious ad/iframe into a trusted site) containing JavaScript that manipulates IndexedDB objects to trigger the use-after-free. A Firefox user browsing to that page has the freed memory reclaimed and controlled, corrupting content-process memory toward information disclosure or code execution. No public exploit code was identified at time of analysis, and successful exploitation requires the victim to actively visit attacker-controlled content (UI:R).
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
No patch listed yet 0.3% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Sep 29, 2026

Use-after-free in Mozilla Firefox's IndexedDB storage implementation allows a remote, unauthenticated attacker to execute arbitrary code with the victim's privileges by convincing them to load attacker-controlled web content that exercises the IndexedDB API. CVSS 3.1 scores it 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), reflecting high confidentiality, integrity, and availability impact, with the only meaningful barrier being the required user interaction - no authentication or non-default configuration is needed. Mozilla fixed the flaw in Firefox 157, Firefox ESR 153.4, Firefox ESR 140.17, and Firefox ESR 115.42; no public exploit code or confirmed active exploitation was identified at time of analysis, but given Firefox's enormous install base and the browser-context code execution primitive, this warrants priority patching rather than emergency escalation.

RemediationAI

The primary fix is to upgrade: Firefox to 157 or later, and Extended Support Release installations to ESR 153.4, ESR 140.17, or ESR 115.42 depending on the branch in use, as documented in Mozilla advisories MFSA 2026-97, MFSA 2026-98, MFSA 2026-99, and MFSA 2026-100 (https://www.mozilla.org/security/advisories/mfsa2026-100/), with technical detail in bug 2068346. Because the vector is UI:R/PR:N, the exposure is any browsing session that reaches attacker-controlled content, so prioritize rapid fleet-wide updates - enterprise deployments should force ESR updates via the UpdatePolicy/AppUpdateURL enterprise policies rather than relying on user-initiated updates, since a stale ESR install remains exploitable indefinitely. There is no granular feature switch that cleanly removes the attack surface: disabling the IndexedDB API (dom.indexedDB.enabled) in about:config does prevent this specific trigger, but it breaks a large number of legitimate web applications and is therefore only viable as a short-lived, tightly scoped containment step for high-value but non-browsing workloads; disabling JavaScript entirely for untrusted sites is more effective but has the same or greater functional trade-off. Blocking known malicious domains or applying network-level content filtering can reduce the odds of reaching a trigger page but is bypassable and should not be treated as an equivalent to patching. No public exploit code has been identified at time of analysis, so there is no patch-vs-mitigation race, but the fixes are already released and should be applied promptly.

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

The affected code lives in Firefox's Storage component, specifically the IndexedDB implementation - the standard, enabled-by-default browser database API that web pages use for structured client-side storage. This is a CWE-416 use-after-free: a heap object is freed while a reference to it is still retained, and subsequent dereference of that dangling pointer reads or writes memory the allocator may have already recycled. In a browser engine this class of bug is typically reachable entirely from a sandboxed web page and can be shaped by an attacker via heap grooming into memory corruption that escapes the content process, yielding code execution, or at minimum leaking memory contents (the reported information-disclosure and memory-corruption tags align with this). The CVSS vector confirms the attack is network-delivered, requires no privileges (PR:N) and no user authentication, but is gated by UI:R - the victim must load attacker-controlled content. The affected CPE is cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*, and the fix is tracked in Mozilla bug 2068346 with the release advisories MFSA 2026-97, 2026-98, 2026-99, and 2026-100 covering the affected channels.

Know when Firefox gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (mozilla) PRIMARY 8.8 HIGH
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
vuln.today AI 8.8 HIGH

Network-delivered via web content with no auth (PR:N) but requiring the victim to load a malicious page (UI:R); a browser UAF plausibly yields full content-process compromise, so C/I/A:H.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE MEDIUM
Red Hat 7.5 HIGH

Primary rating from Vendor (mozilla).

CVSS VectorVendor: mozilla

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

3
CVSS changed
Sep 29, 2026 - 15:22 NVD
8.8 (HIGH)
CVE Published
Sep 29, 2026 - 12:36 cve.org
HIGH 8.8
CVE Published
Sep 29, 2026 - 12:36 cve.org
UNKNOWN (no severity yet)

DescriptionCVE.org

Use-after-free in the Storage: IndexedDB component. This vulnerability was fixed in Firefox ESR 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.

Executive ViewAI

Why It Matters

Mozilla Firefox, one of the most widely deployed browsers across the organization's workforce, contains a high-severity memory-safety flaw in its IndexedDB storage component that can lead to attacker code execution on any user's device with that user's privileges. Exploitation requires only that an employee browse to attacker-controlled web content - no credentials, elevated access, or non-standard configuration are needed - meaning the entire browsing population is a potential target and a single visit could compromise endpoints, credentials, and data. Mozilla has released fixed versions, so exposure is now a matter of patch cadence rather than unavailable remediation, and leadership should treat unmanaged or update-delayed Firefox installations as the primary residual risk.

Business Impact: High
Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

EPSS Score
0.3%
Top 75% exploitable
Prevalence
Ubiquitous
Firefox is a top-tier mainstream browser deployed across desktops worldwide
Data Quality
7 sources
Confidence: High
EUVD 🇯🇵JVN NVD CVE.org EPSS Vulnrichment Vendor VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.3%
Patch available No
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision
Scheduled
Exploitation
None
System Exposure· derived
Open
Automatable
No
Human Impact
High
Technical Impact
Total

Priority Score

44
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +44
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Use After Free HIGH

Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.

Memory Corruption HIGH

Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.

Affected Products (CPE)CVE.org

cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*

More in Firefox

View all
CVE-2013-0758 CRITICAL POC
9.3 Jan 13

Mozilla Firefox before 18.0, Firefox ESR 10.x before 10.0.12 and 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderb
CVE-2013-0753 CRITICAL POC
9.3 Jan 13

Use-after-free vulnerability in the serializeToStream implementation in the XMLSerializer component in Mozilla Firefox b
CVE-2012-3993 CRITICAL POC
9.3 Oct 10

The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbi
CVE-2013-1710 CRITICAL POC
10.0 Aug 07

The crypto.generateCRMFRequest function in Mozilla Firefox before 23.0, Firefox ESR 17.x before 17.0.8, Thunderbird befo
CVE-2014-8636 HIGH POC
7.5 Jan 14

The XrayWrapper implementation in Mozilla Firefox before 35.0 and SeaMonkey before 2.32 does not properly interact with

CVE-2013-0757 CRITICAL POC
9.3 Jan 13

The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 18.0, Firefox ESR 17.x before 17.0.2, Thunderbi
CVE-2014-1510 CRITICAL POC
9.8 Mar 19

The Web IDL implementation in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and Se
CVE-2014-1511 CRITICAL POC
9.8 Mar 19

Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and SeaMonkey before 2.25 allow remo
CVE-2016-1960 HIGH POC
8.8 Mar 13

Integer underflow in the nsHtml5TreeBuilder class in the HTML5 string parser in Mozilla Firefox before 45.0 and Firefox

CVE-2015-0816 MEDIUM POC
5.0 Apr 01

Mozilla Firefox before 37.0, Firefox ESR 31.x before 31.6, and Thunderbird before 31.6 do not properly restrict resource
CVE-2015-0802 MEDIUM POC
5.0 Apr 01

Mozilla Firefox before 37.0 relies on docshell type information instead of page principal information for Window.webidl

CVE-2013-2566 MEDIUM POC
5.9 Mar 15

The RC4 algorithm, as used in the TLS protocol and SSL protocol, has many single-byte biases, which makes it easier for

Same weakness CWE-416 – Use After Free

View all
CVE-2019-0708 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2014-0322 HIGH POC
8.8
CVE-2012-4792 HIGH POC
8.8
CVE-2009-4324 HIGH POC
7.8
CVE-2015-0313 CRITICAL POC
9.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2013-2551 HIGH POC
8.8

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2025-68613 HIGH POC
8.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Module for Desktop Applications 15 SP7 Affected
SUSE Linux Enterprise Module for Package Hub 15 SP7 Affected
SUSE Linux Enterprise Server 15 SP7 Affected

References

Advisories & patches
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-100773 ADVISORY https://vuldb.com/vuln/411340 REF https://bugzilla.mozilla.org/show_bug.cgi?id=2068346 REF https://www.mozilla.org/security/advisories/mfsa2026-100/ REF https://www.mozilla.org/security/advisories/mfsa2026-101/ REF https://www.mozilla.org/security/advisories/mfsa2026-102/ REF https://www.mozilla.org/security/advisories/mfsa2026-103/ REF https://www.mozilla.org/security/advisories/mfsa2026-97/ REF https://www.mozilla.org/security/advisories/mfsa2026-98/ REF https://www.mozilla.org/security/advisories/mfsa2026-99/

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy