EUVD-2026-88932
GHSA-wmqw-hpqq-jp4m
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessHost crafted malicious web page
-
DeliveryLure victim to load page in Firefox
-
ExploitTrigger use-after-free in DOM Core/HTML
-
ExecutionReallocate freed object to corrupt memory
-
ImpactExecute attacker code in content process
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to actively load attacker-controlled web content in an unpatched Firefox (UI:R) - there is no server-side or unauthenticated remote-service exposure; the flaw lives in client-side DOM Core & HTML rendering. No special product configuration is needed since it affects default browsing, but success depends on winning the use-after-free reallocation and defeating browser sandboxing/mitigations, and it is limited to versions before Firefox 157, ESR 153.4, ESR 140.17, and ESR 115.42. |
| Impact | All signals point to a browser memory-corruption bug of standard severity for the class, not an emergency. CVSS 3.1 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) is internally consistent with the description: network-reachable via a crafted web page, low complexity, no privileges, but requiring user interaction (victim must load attacker content). I concur with the 8.8. Critically, exploitation status is 'no public exploit identified at time of analysis' - there is no EPSS score, no CISA KEV listing, and no POC in the provided data; this is a Mozilla self-reported/self-fixed defect disclosed alongside the fix, which is the normal pattern for internally-found browser UAFs. No SSVC framing is supplied. Note the CVSS C:H/I:H/A:H reflects the memory-corruption/RCE-class ceiling of a UAF, whereas the 'Information Disclosure' tag understates it - this is memory corruption, not merely an info leak. Bottom line: real but routine - high theoretical impact, no evidence of active or imminent exploitation, and mitigated in practice by the UI:R requirement and the availability of a patch. |
| Exploit ScenarioDerived | An attacker hosts a malicious web page that manipulates DOM Core/HTML objects to trigger a use-after-free, then lures a victim running an unpatched Firefox to visit it (e.g., via a link or malvertising). Freeing and reallocating the dangling object lets the attacker corrupt memory in the content process, potentially achieving arbitrary code execution within the browser sandbox. No public POC or exploit is identified in the provided data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 29, 2026
A use-after-free flaw in Firefox's DOM Core & HTML component (CWE-416) can corrupt browser memory when a victim loads attacker-controlled web content, with a CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). All supported release channels are affected below the fixed builds - Firefox 157, Firefox ESR 153.4, Firefox ESR 140.17, and Firefox ESR 115.42 - and the flaw is exploitable by unauthenticated remote attackers only if the user actively visits or is induced to load a malicious page (UI:R), with no server-side exposure. No public exploit code and no confirmed active exploitation were identified at time of analysis; impact ranges from information disclosure and memory corruption to a potentially exploitable crash or code execution, though reliable exploitation requires winning the heap reallocation race and defeating browser sandbox mitigations, placing it in the normal severity band for this bug class rather than an emergency.
RemediationAI
Vendor-released patches fix this issue in Firefox 157 and in the ESR channels Firefox ESR 153.4, Firefox ESR 140.17, and Firefox ESR 115.42, so the primary action is to upgrade to or above the build matching your deployment channel and, for organizations, enforce that version through enterprise policy to prevent silent regressions. Because Firefox auto-updates by default, verify that update enforcement has not been disabled and monitor MFSA 2026-100, MFSA 2026-99, MFSA 2026-98, and MFSA 2026-97 (linked at https://www.mozilla.org/security/advisories/mfsa2026-100/) plus Bugzilla 2068422 for any revision. No vendor-released patch was identified at time of analysis beyond these fixed versions, so until upgrade is possible the practical compensating controls are to keep the browser's process sandbox and site isolation enabled, avoid opening untrusted or unsolicited links in unpatched builds, and rely on enterprise content filtering or network-level blocking of suspicious sites - with the trade-off that these are partial, probabilistic defenses since the flaw is triggered by ordinary page rendering, and disabling JavaScript or the DOM features involved is not a realistic mitigation for general browsing. Isolating high-risk browsing to a separate, fully updated browser profile or sandboxed environment reduces the blast radius but does not eliminate exposure for users who continue browsing the web in the vulnerable build.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is a use-after-free (CWE-416) inside the DOM: Core & HTML implementation that underpins document parsing, node tree construction, and event/element handling in Gecko. A freed DOM-related object can be referenced again after its memory has been released, so an attacker who controls page content - markup, script, or element lifecycles - may be able to reclaim that freed allocation with data of their choosing and induce memory corruption. The Intel-tagged reference CPE (cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*) confirms the affected platform is Mozilla's browser across release and ESR channels, and the accompanying tags (Use After Free, Memory Corruption, Information Disclosure) align with the CWE class. The CVSS vector's PR:N plus UI:R reflects a classic client-side, drive-by pattern: no credentials are required, but the victim must render the malicious content, and the practical ceiling on impact depends on whether the corrupted object can be leveraged past Firefox's process sandbox and exploit mitigations.
Know when Firefox gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Network-delivered crafted page (AV:N) needing victim to load it (UI:R), no privileges, content-process memory corruption yielding full C/I/A within an unchanged scope.
Primary rating from Vendor (mozilla).
CVSS VectorVendor: mozilla
Lifecycle Timeline
3DescriptionCVE.org
Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox ESR 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.
Executive ViewAI
A high-severity use-after-free vulnerability in Mozilla Firefox's DOM Core & HTML component (CVE-2026-100780) affects all supported release channels below fixed builds, potentially leading to memory corruption and code execution when users load malicious web content. Although no public exploit identified at time of analysis, the flaw is remotely exploitable by unauthenticated attackers if a user visits a crafted page, posing a risk of data compromise or endpoint takeover across the organization. Leadership should prioritize updating Firefox to the vendor-fixed versions to mitigate this threat.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Affected Products (CPE)CVE.org
Mozilla Firefox before 18.0, Firefox ESR 10.x before 10.0.12 and 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderb
Use-after-free vulnerability in the serializeToStream implementation in the XMLSerializer component in Mozilla Firefox b
The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbi
The crypto.generateCRMFRequest function in Mozilla Firefox before 23.0, Firefox ESR 17.x before 17.0.8, Thunderbird befo
The XrayWrapper implementation in Mozilla Firefox before 35.0 and SeaMonkey before 2.32 does not properly interact with
The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 18.0, Firefox ESR 17.x before 17.0.2, Thunderbi
The Web IDL implementation in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and Se
Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and SeaMonkey before 2.25 allow remo
Integer underflow in the nsHtml5TreeBuilder class in the HTML5 string parser in Mozilla Firefox before 45.0 and Firefox
Mozilla Firefox before 37.0, Firefox ESR 31.x before 31.6, and Thunderbird before 31.6 do not properly restrict resource
Mozilla Firefox before 37.0 relies on docshell type information instead of page principal information for Window.webidl
The RC4 algorithm, as used in the TLS protocol and SSL protocol, has many single-byte biases, which makes it easier for
Exploit-DB