CRITICAL 9.6 NVD
CVE-2026-100778
Sandbox escape due to use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox ESR 153.4, Firefox 157, Firefox ESR 115.42, and
Sandbox escape due to use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox ESR 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.
References
- https://bugzilla.mozilla.org/show_bug.cgi?id=2068406
- https://www.mozilla.org/security/advisories/mfsa2026-100/
- https://www.mozilla.org/security/advisories/mfsa2026-97/
- https://www.mozilla.org/security/advisories/mfsa2026-98/
- https://www.mozilla.org/security/advisories/mfsa2026-99/
This critical severity vulnerability with a CVSS score of 9.6 was published on 2026-09-29 via NVD.
Risk Timeline
CVE Disclosed2026-09-29 · 0 days ago
Remediation Resources
Official Advisory
www.mozilla.org/security/advisories/mfsa2026-100/Official Advisory
www.mozilla.org/security/advisories/mfsa2026-97/Analysis & PoC
bugzilla.mozilla.org/show_bug.cgi?id=2068406
vulnfeed aggregates 10239 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.