EUVD-2026-88946
GHSA-8j79-hq86-r8v5
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessHost malicious i18n-triggering web page
-
DeliveryVictim visits page in unpatched Firefox
-
ExploitChain content-process bug for in-sandbox code exec
-
ExecutionTrigger boundary condition in Internationalization component
-
PersistEscape sandbox to host process
-
ImpactExecute code with browser-host privileges
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, buffer size validation
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires an unpatched Firefox (before 157, ESR before 153.4, or ESR before 140.17) and a victim who loads attacker-controlled web content (UI:R) that exercises the Internationalization component's flawed boundary condition. The decisive limiting factor is that this is a sandbox escape, not a direct RCE: the attacker must already have code execution inside the content-process sandbox, so it must be chained with a separate content-process memory-corruption vulnerability to be fully impactful. No authentication is required (PR:N) and the component is reachable in default configurations, but the chaining requirement and need for user interaction materially reduce standalone exploitability. |
| Impact | Signals are mixed and should be read against the nature of the flaw. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H, 9.6) scores a sandbox escape in Firefox's Internationalization component as near-critical, driven by the scope change (S:C) from the content process into the host and full CIA impact - consistent with a sandbox-escape primitive. However, a sandbox escape is rarely exploitable in isolation: it must be chained with a separate content-process memory-corruption bug to first achieve code execution inside the sandbox, which the raw score does not reflect. Counterbalancing the high CVSS, EPSS is only 0.16% (4th percentile), there is no CISA KEV listing and no public exploit identified, indicating no evidence of real-world exploitation. Mozilla self-reported and patched this (FF157, ESR 153.4, ESR 140.17); browser memory-safety bugs are routinely found internally and fixed before weaponization. Net: a genuinely important browser patch (high prevalence, severe potential impact if chained) but not an emergency - important-not-emergency, with no active-exploitation signal. |
| Exploit ScenarioDerived | An attacker hosts a malicious web page that first exploits a separate content-process vulnerability to run code inside Firefox's sandbox, then triggers the incorrect boundary condition in the Internationalization component to break out of the sandbox and execute code in the host/parent process. The victim need only visit the page in an unpatched Firefox (UI:R). No public exploit or active exploitation is known at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 01, 2026
Mozilla Firefox's Internationalization component contains incorrect boundary conditions that permit a sandbox escape, allowing an attacker who already has code execution inside the content process to break out of the browser sandbox. The flaw affects Firefox before 157, Firefox ESR before 153.4, and Firefox ESR before 140.17; exploitation requires a victim to load attacker-controlled web content (UI:R) and typically must be chained with a separate content-process memory-corruption vulnerability because this is not a direct remote code execution flaw. No public exploit code has been identified at the time of analysis, and EPSS is 0.16% (4th percentile), indicating low predicted exploitation activity despite the critical CVSS score of 9.6.
RemediationAI
Vendor-released patches are available: upgrade to Firefox 157, Firefox ESR 153.4, or Firefox ESR 140.17 (or later) as appropriate for your release channel. Mozilla advisories mfsa2026-97, mfsa2026-99, mfsa2026-100, mfsa2026-101, mfsa2026-102, and mfsa2026-103 provide the official guidance. If immediate upgrade is not possible, reduce exposure by keeping the browser inside an isolated virtual machine or container to contain a sandbox escape, and prioritize patching any additional content-process memory-corruption vulnerabilities because this flaw must be chained; these measures carry performance and usability trade-offs, and they do not replace the vendor fix.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability sits in Firefox's Internationalization component, which handles locale data, Unicode text processing, and related Intl/ICU functionality. CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer) points to a buffer overflow or out-of-bounds memory access caused by incorrect boundary conditions, likely in code that processes attacker-influenced strings or locale structures reachable from a content process. The CVSS vector is AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H, indicating an unauthenticated network-reachable flaw (PR:N) that requires victim interaction (UI:R) and can change scope (S:C), so an attacker must persuade a user to load malicious content. Mozilla classifies the impact as a sandbox escape because successful corruption in a privileged process or IPC handler can bypass the browser's content sandbox, but the attacker first needs a content-process compromise to reach the vulnerable code path. The CPE cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:* confirms that all versions of Mozilla Firefox are in scope prior to the fixed releases, and the referenced Mozilla advisories and Bugzilla entry document the fix.
Know when Firefox gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
Sources disagree (Medium–Critical)AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Remote attacker-controlled content, victim must load page (UI:R); sandbox escape crosses from content process to host so S:C with full CIA impact.
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: mozilla
Lifecycle Timeline
3DescriptionCVE.org
Sandbox escape due to incorrect boundary conditions in the Internationalization component. This vulnerability was fixed in Firefox ESR 153.4, Firefox 157, and Firefox ESR 140.17.
Executive ViewAI
Mozilla Firefox and Firefox ESR are affected by an unpatched critical sandbox-escape vulnerability (CVE-2026-100794) that could allow an attacker with existing code execution in the browser content process to break out and reach the underlying endpoint. Organizations running Firefox before 157 or Firefox ESR before 153.4/140.17 should treat this as a defense-in-depth failure that raises risk for browser-dependent and high-value users, especially if chained with a separate memory-corruption flaw. There is currently no public exploit identified at time of analysis, and exploitation requires a victim to load attacker-controlled web content plus a separate initial compromise, so this is a preparedness and patch-management issue rather than an immediate mass-exploitation event.
No vendor-released patch identified at time of analysis; interim mitigations include enforcing Firefox enterprise hardening and sandbox policies, isolating high-risk browsing in remote or virtualized environments, maintaining EDR coverage, limiting privileged browsing, and remediating separate content-process memory-corruption flaws that could enable the required initial foothold.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Affected Products (CPE)CVE.org
Mozilla Firefox before 18.0, Firefox ESR 10.x before 10.0.12 and 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderb
Use-after-free vulnerability in the serializeToStream implementation in the XMLSerializer component in Mozilla Firefox b
The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbi
The crypto.generateCRMFRequest function in Mozilla Firefox before 23.0, Firefox ESR 17.x before 17.0.8, Thunderbird befo
The XrayWrapper implementation in Mozilla Firefox before 35.0 and SeaMonkey before 2.32 does not properly interact with
The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 18.0, Firefox ESR 17.x before 17.0.2, Thunderbi
The Web IDL implementation in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and Se
Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and SeaMonkey before 2.25 allow remo
Integer underflow in the nsHtml5TreeBuilder class in the HTML5 string parser in Mozilla Firefox before 45.0 and Firefox
Mozilla Firefox before 37.0, Firefox ESR 31.x before 31.6, and Thunderbird before 31.6 do not properly restrict resource
Mozilla Firefox before 37.0 relies on docshell type information instead of page principal information for Window.webidl
The RC4 algorithm, as used in the TLS protocol and SSL protocol, has many single-byte biases, which makes it easier for
Exploit-DB