CVE-2026-100757

Use-after-free in the Widget component

Published Sep 29, 2026 CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Description

Use-after-free in the Widget component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.

Analysis

Technical impact

The flaw is a use‑after‑free in the Widget component, which can be triggered by malicious content and may allow arbitrary code execution or a crash. The vulnerability has been addressed in several newer releases, including Firefox 157, Firefox ESR 153.4, Firefox ESR 115.42, Firefox ESR 140.17, Thunderbird 157, Thunderbird 153.4, and Thunderbird 140.17.

Affected Systems

Mozilla Firefox and Mozilla Thunderbird are affected, with the patch included in Firefox ESR 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17, and in Thunderbird 157, Thunderbird 153.4, and Thunderbird 140.17. Versions older than those enumerated remain vulnerable.

Risk and Exploitability

The CVSS score of 8.8 is available, and the EPSS score is less than 1%. The vulnerability is not listed in CISA KEV. The likely attack vector is through malicious web content that triggers the widget, enabling a remote attacker to exploit the use‑after‑free for code execution or denial of service.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Mozilla

Firefox

affected

Version	Status	Constraints
`115.42`	unaffected	≤ 115.*
`140.17`	unaffected	≤ 140.*
`153.4`	unaffected	≤ 153.*
`157`	unaffected	≤ *

Mozilla

Thunderbird

affected

Version	Status	Constraints
`140.17`	unaffected	≤ 140.*
`153.4`	unaffected	≤ 153.*
`157`	unaffected	≤ *

Configuration 1 [-]

OR	cpe:2.3:a:mozilla:firefox::::::::
	cpe:2.3:a:mozilla:firefox::::::::
	cpe:2.3:a:mozilla:firefox::::::::
	cpe:2.3:a:mozilla:firefox::::::::
	cpe:2.3:a:mozilla:thunderbird::::::::
	cpe:2.3:a:mozilla:thunderbird::::::::
	cpe:2.3:a:mozilla:thunderbird::::::::

No data.

Vendor Product Versions

Mozilla

Firefox

Version	Status	Scheme	Platform
`[115.42,115.*]`	unaffected	generic	—
`[140.17,140.*]`	unaffected	generic	—
`[153.4,153.*]`	unaffected	generic	—
`[157,*]`	unaffected	generic	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade to Firefox 157 or a newer release, or to ESR 153.4, ESR 115.42, or ESR 140.17 which contain the patch.
If an update cannot be applied, disable the widget component via about:config or remove the related plugin to prevent exploitation.
Monitor browser behavior and logs for anomalies that could indicate exploitation attempts.

Generated by OpenCVE AI on October 1, 2026 at 03:21 UTC.

Tracking

Advisories

Source	ID	Title
Debian DLA	DLA-4810-1	thunderbird security update
Debian DLA	DLA-4814-1	firefox-esr security update
Debian DSA	DSA-6533-1	firefox-esr security update
Debian DSA	DSA-6536-1	thunderbird security update

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.319% probability within 30 days)

Exploitation none

Automatable no

Technical Impact total

References

Link	Providers
https://bugzilla.mozilla.org/show_bug.cgi?id=2049352
https://www.mozilla.org/security/advisories/mfsa2026-100/
https://www.mozilla.org/security/advisories/mfsa2026-101/
https://www.mozilla.org/security/advisories/mfsa2026-102/
https://www.mozilla.org/security/advisories/mfsa2026-103/
https://www.mozilla.org/security/advisories/mfsa2026-97/
https://www.mozilla.org/security/advisories/mfsa2026-98/
https://www.mozilla.org/security/advisories/mfsa2026-99/

History

Oct 13, 2026 9:15 PM First appearance in the feed. Affected versions updated. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Mozilla thunderbird
CPEs		cpe:2.3:a:mozilla:firefox:::::::: cpe:2.3:a:mozilla:thunderbird::::::::
Vendors & Products		Mozilla thunderbird

Sep 30, 2026 5:45 PM Description updated. Added references View changes

Type	Values Removed	Values Added
Description	Use-after-free in the Widget component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.	Use-after-free in the Widget component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.
References		https://www.mozilla.org/security/advisories/mfsa2026-102/ https://www.mozilla.org/security/advisories/mfsa2026-103/

Sep 30, 2026 5:30 PM Description updated. Added references View changes

Type	Values Removed	Values Added
Description	Use-after-free in the Widget component. This vulnerability was fixed in Firefox ESR 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.	Use-after-free in the Widget component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.
References		https://www.mozilla.org/security/advisories/mfsa2026-101/

Sep 30, 2026 5:15 AM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Mozilla Mozilla firefox
Vendors & Products		Mozilla Mozilla firefox

Sep 29, 2026 4:30 PM Weaknesses updated. Scoring metrics updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-416
Metrics		cvssV3_1 `{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'}` ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Sep 29, 2026 1:15 PM Description updated. Title updated. Added references View changes

Type	Values Removed	Values Added
Description		Use-after-free in the Widget component. This vulnerability was fixed in Firefox ESR 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.
Title		Use-after-free in the Widget component
References		https://bugzilla.mozilla.org/show_bug.cgi?id=2049352 https://www.mozilla.org/security/advisories/mfsa2026-100/ https://www.mozilla.org/security/advisories/mfsa2026-97/ https://www.mozilla.org/security/advisories/mfsa2026-98/ https://www.mozilla.org/security/advisories/mfsa2026-99/