CVE-2026-100762

Sandbox escape due to use-after-free in the DOM: Content Processes component

Published Sep 29, 2026 CVSS 3.1 · 9.6 Critical EPSS < 1% KEV · Not listed

Description

Sandbox escape due to use-after-free in the DOM: Content Processes component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.

Analysis

Technical impact

Firefox’s Content Processes component contains a use‑after‑free bug in the DOM that can lead to a sandbox escape. This flaw arises from improper memory deallocation and subsequent reuse. Based on the description, the escape could potentially allow an attacker to break isolation between content processes and the rest of the system, effectively raising privileges within the browser context.

Affected Systems

The vulnerability is present in Mozilla Firefox releases prior to ESR 153.4, Firefox 157, ESR 115.42, and ESR 140.17, as well as in Mozilla Thunderbird releases prior to 157, 140.17, and 153.4. Users running these affected builds, or older ESR versions, are exposed, while any edition that includes one of the listed fix versions provides protection.

Risk and Exploitability

The CVSS score is 9.6, indicating a critical severity, and the EPSS score is less than 1%, implying a very low probability of exploitation at this time. The vulnerability is not listed in the CISA KEV catalog, so no active exploitation campaigns are publicly known. Attackers would need to trigger the use‑after‑free condition, likely via crafted web content, but the exact attack vector is not supplied in the data.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Mozilla

Firefox

affected

Version	Status	Constraints
`115.42`	unaffected	≤ 115.*
`140.17`	unaffected	≤ 140.*
`153.4`	unaffected	≤ 153.*
`157`	unaffected	≤ *

Mozilla

Thunderbird

affected

Version	Status	Constraints
`140.17`	unaffected	≤ 140.*
`153.4`	unaffected	≤ 153.*
`157`	unaffected	≤ *

Configuration 1 [-]

OR	cpe:2.3:a:mozilla:firefox::::::::
	cpe:2.3:a:mozilla:firefox::::::::
	cpe:2.3:a:mozilla:firefox::::::::
	cpe:2.3:a:mozilla:firefox::::::::
	cpe:2.3:a:mozilla:thunderbird::::::::
	cpe:2.3:a:mozilla:thunderbird::::::::
	cpe:2.3:a:mozilla:thunderbird::::::::

No data.

Vendor Product Versions

Mozilla

Firefox

Version	Status	Scheme	Platform
`[115.42,116.0.0)`	unaffected	generic	—
`[140.17,141.0.0)`	unaffected	generic	—
`[153.4,154.0.0)`	unaffected	generic	—
`[157,*]`	unaffected	generic	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Update to Firefox 157 or later, or to any newer ESR release that includes the fix (e.g., ESR 115.42, 140.17, or 153.4).
If an update cannot be applied immediately, restrict the loading of untrusted content by disabling third‑party plugins or using content filtering to block scripts that may trigger the bug.
Continuously monitor Mozilla security advisories and deploy subsequent patches as soon as they are released.

Generated by OpenCVE AI on October 7, 2026 at 08:00 UTC.

Tracking

Advisories

Source	ID	Title
Debian DLA	DLA-4810-1	thunderbird security update
Debian DLA	DLA-4814-1	firefox-esr security update
Debian DSA	DSA-6533-1	firefox-esr security update
Debian DSA	DSA-6536-1	thunderbird security update

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Changed

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.319% probability within 30 days)

Exploitation none

Automatable no

Technical Impact total

References

Link	Providers
https://bugzilla.mozilla.org/show_bug.cgi?id=2059404
https://nvd.nist.gov/vuln/detail/CVE-2026-100762
https://www.cve.org/CVERecord?id=CVE-2026-100762
https://www.mozilla.org/security/advisories/mfsa2026-100/
https://www.mozilla.org/security/advisories/mfsa2026-101/
https://www.mozilla.org/security/advisories/mfsa2026-102/
https://www.mozilla.org/security/advisories/mfsa2026-102/#CVE-2026-100762
https://www.mozilla.org/security/advisories/mfsa2026-103/
https://www.mozilla.org/security/advisories/mfsa2026-97/
https://www.mozilla.org/security/advisories/mfsa2026-98/
https://www.mozilla.org/security/advisories/mfsa2026-99/
https://www.mozilla.org/security/advisories/mfsa2026-99/#CVE-2026-100762

History

Oct 13, 2026 7:00 PM First appearance in the feed. Affected versions updated. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Mozilla thunderbird
CPEs		cpe:2.3:a:mozilla:firefox:::::::: cpe:2.3:a:mozilla:thunderbird::::::::
Vendors & Products		Mozilla thunderbird

Oct 6, 2026 12:15 PM Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-825
References		https://nvd.nist.gov/vuln/detail/CVE-2026-100762 https://www.cve.org/CVERecord?id=CVE-2026-100762 https://www.mozilla.org/security/advisories/mfsa2026-102/#CVE-2026-100762 https://www.mozilla.org/security/advisories/mfsa2026-99/#CVE-2026-100762
Metrics	threat_severity `None`	threat_severity `Important`

Sep 30, 2026 5:45 PM Description updated. Added references View changes

Type	Values Removed	Values Added
Description	Sandbox escape due to use-after-free in the DOM: Content Processes component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.	Sandbox escape due to use-after-free in the DOM: Content Processes component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.
References		https://www.mozilla.org/security/advisories/mfsa2026-102/ https://www.mozilla.org/security/advisories/mfsa2026-103/

Sep 30, 2026 5:30 PM Description updated. Added references View changes

Type	Values Removed	Values Added
Description	Sandbox escape due to use-after-free in the DOM: Content Processes component. This vulnerability was fixed in Firefox ESR 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.	Sandbox escape due to use-after-free in the DOM: Content Processes component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.
References		https://www.mozilla.org/security/advisories/mfsa2026-101/

Sep 30, 2026 2:45 AM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Mozilla Mozilla firefox
Vendors & Products		Mozilla Mozilla firefox

Sep 29, 2026 5:30 PM Weaknesses updated. Scoring metrics updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-416
Metrics		cvssV3_1 `{'score': 9.6, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H'}` ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Sep 29, 2026 1:15 PM Description updated. Title updated. Added references View changes

Type	Values Removed	Values Added
Description		Sandbox escape due to use-after-free in the DOM: Content Processes component. This vulnerability was fixed in Firefox ESR 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.
Title		Sandbox escape due to use-after-free in the DOM: Content Processes component
References		https://bugzilla.mozilla.org/show_bug.cgi?id=2059404 https://www.mozilla.org/security/advisories/mfsa2026-100/ https://www.mozilla.org/security/advisories/mfsa2026-97/ https://www.mozilla.org/security/advisories/mfsa2026-98/ https://www.mozilla.org/security/advisories/mfsa2026-99/