CVE-2026-100759

Uninitialized memory in the Storage: Quota Manager component may allow a malicious agent to read data that has not been properly initialized by the browser. This flaw can expose sensitive information, such as credentials or personal data, that are not intended to be visible to the browser process.

Mozilla products such as Firefox and Thunderbird are affected when they run versions older than Firefox ESR 153.4, ESR 140.17, ESR 115.42, or the 157 release, and Thunderbird versions older than 157, 140.17, or 153.4. All releases that have not applied these specific patches remain at risk.

The EPSS score is below 1 % and the vulnerability is not listed in CISA’s KEV catalog, indicating that exploitation attempts are likely rare and that the public danger is modest. The CVSS score of 8.1 denotes high severity. The attack vector is not explicitly declared in the description, but it is inferred that an attacker would need either local access or the ability to deliver crafted web content that activates quota management logic. Because the flaw relies on a particular memory state, brute‑force exploitation would be difficult. Even so, the potential impact of leaking internal data warrants a moderate risk assessment until the vendor issues a patch.