CVE-2026-100758

The description identifies a sandbox escape in the DOM navigation component that permits crafted navigation requests to bypass the browser’s sandbox, enabling execution of code with elevated privileges. This weakness stems from insufficient validation of navigation inputs, resulting in a breach of the security boundary that normally isolates web content.

All Mozilla Firefox builds prior to the following fixed releases are affected: Firefox ESR 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17. In addition, all Thunderbird builds prior to Thunderbird 157, Thunderbird 140.17, or Thunderbird 153.4 are vulnerable. Any older ESR releases or older Thunderbird versions that have not been updated beyond these versions remain vulnerable.

The EPSS score is <1% and the vulnerability is not listed in the CISA KEV catalog, but sandbox escape bugs typically carry high severity due to the potential for remote code execution. Based on the description, it is inferred that the attack vector involves delivering crafted content to the browser’s navigation component. Attacks would require an attacker to supply crafted content that is interpreted by the browser’s navigation logic, which could arise from malicious web pages, emails, or locally opened files. Because the flaw resides in the client‑side DOM processing engine, the attack surface is broad and the exploitation probability is low according to the EPSS score, yet the high CVSS score indicates a critical impact. Nonetheless, the impact and the nature of the flaw justify treating this issue as a critical security risk. The CVSS score of 9.6 further confirms its critical severity.