Sandbox Escape Vulnerability in Firefox by Mozilla
CVE-2026-100811

9.6CRITICAL

Key Information:

Vendor

Mozilla
Status
Thunderbird
Firefox
Vendor
CVE Published:
29 September 2026

What is CVE-2026-100811?

A sandbox escape vulnerability has been identified due to a use-after-free error in the DOM components of Mozilla Firefox. This flaw could potentially allow an attacker to manipulate the document object model, leading to unauthorized actions within a restricted environment. Updates to address this vulnerability have been released in specific versions, including Firefox ESR 153.4, Firefox 157, and Firefox ESR 140.17, highlighting the importance of keeping browsers up to date to mitigate security risks.

Affected Version(s)

Firefox 140.17

Firefox 153.4

Firefox 157

References

https://bugzilla.mozilla.org/show_bug.cgi?id=2067973
https://www.mozilla.org/security/advisories/mfsa2026-100/
https://www.mozilla.org/security/advisories/mfsa2026-101/

CVSS V3.1

Score:
9.6
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Yaqoub Aldurayhim
.