CVE-2026-100775

Sandbox escape in the Graphics component

Published Sep 29, 2026 CVSS 3.1 · 9.6 Critical EPSS < 1% KEV · Not listed

Description

Sandbox escape in the Graphics component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.

Analysis

Technical impact

The flaw lies in the graphics component of Mozilla applications and permits a process to escape the confines of its sandbox during rendering. Inadequate enforcement of sandbox boundaries can enable the process to execute code with higher privileges than the sandbox permits, thereby potentially compromising both the application and the underlying system. The weakness is identified as CWE‑693 (Improper Handling of Error Conditions).

Affected Systems

Mozilla Firefox and Mozilla Thunderbird are affected. The vulnerability is fixed in Firefox ESR releases 115.42, 140.17, and 153.4, as well as in Firefox 157; and in Thunderbird releases 140.17, 153.4, and 157. Versions older than those releases remain vulnerable.

Risk and Exploitability

The EPSS score of less than 1 % indicates a low probability of exploitation in the wild, but the CVSS score of 9.6 categorizes the vulnerability as critical. The flaw is not listed in CISA’s KEV catalog and currently no public exploits are known. The likely attack vector is inferred to involve content that triggers the graphics subsystem—such as a malicious web page, document, or plugin—because the vulnerability arises when graphics rendering occurs.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Mozilla

Firefox

affected

Version	Status	Constraints
`115.42`	unaffected	≤ 115.*
`140.17`	unaffected	≤ 140.*
`153.4`	unaffected	≤ 153.*
`157`	unaffected	≤ *

Mozilla

Thunderbird

affected

Version	Status	Constraints
`140.17`	unaffected	≤ 140.*
`153.4`	unaffected	≤ 153.*
`157`	unaffected	≤ *

Configuration 1 [-]

OR	cpe:2.3:a:mozilla:firefox::::::::
	cpe:2.3:a:mozilla:firefox::::::::
	cpe:2.3:a:mozilla:firefox::::::::
	cpe:2.3:a:mozilla:firefox::::::::
	cpe:2.3:a:mozilla:thunderbird::::::::
	cpe:2.3:a:mozilla:thunderbird::::::::
	cpe:2.3:a:mozilla:thunderbird::::::::

No data.

Vendor Product Versions

Mozilla

Firefox

Version	Status	Scheme	Platform
`[115.42,115.*]`	unaffected	generic	—
`[140.17,140.*]`	unaffected	generic	—
`[153.4,153.*]`	unaffected	generic	—
`[157,*]`	unaffected	generic	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade to a patched release of Firefox or Thunderbird—at least Firefox ESR 115.42, ESR 140.17, ESR 153.4, or Firefox 157, and Thunderbird 140.17, 153.4, or 157.
If an update cannot be applied immediately, disable or severely limit the graphics component’s exposure to untrusted content—for example, suppress native canvas operations or block plugins that use the graphics subsystem.
Maintain a subscription to Mozilla security advisories and monitor for emerging exploits to apply additional mitigations as they become available.

Generated by OpenCVE AI on October 1, 2026 at 22:12 UTC.

Tracking

Advisories

Source	ID	Title
Debian DLA	DLA-4810-1	thunderbird security update
Debian DLA	DLA-4814-1	firefox-esr security update
Debian DSA	DSA-6533-1	firefox-esr security update
Debian DSA	DSA-6536-1	thunderbird security update

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Changed

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.328% probability within 30 days)

Exploitation none

Automatable no

Technical Impact total

References

Link	Providers
https://bugzilla.mozilla.org/show_bug.cgi?id=2068367
https://www.mozilla.org/security/advisories/mfsa2026-100/
https://www.mozilla.org/security/advisories/mfsa2026-101/
https://www.mozilla.org/security/advisories/mfsa2026-102/
https://www.mozilla.org/security/advisories/mfsa2026-103/
https://www.mozilla.org/security/advisories/mfsa2026-97/
https://www.mozilla.org/security/advisories/mfsa2026-98/
https://www.mozilla.org/security/advisories/mfsa2026-99/

History

Oct 6, 2026 2:45 PM First appearance in the feed. Affected versions updated. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Mozilla thunderbird
CPEs		cpe:2.3:a:mozilla:firefox:::::::: cpe:2.3:a:mozilla:thunderbird::::::::
Vendors & Products		Mozilla thunderbird

Oct 1, 2026 8:15 PM Weaknesses updated View changes

Type	Values Removed	Values Added
Weaknesses	CWE-284 CWE-285

Oct 1, 2026 5:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Oct 1, 2026 4:30 PM Weaknesses updated. Scoring metrics updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-693
Metrics		cvssV3_1 `{'score': 9.6, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H'}`

Oct 1, 2026 5:00 AM Weaknesses updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-284 CWE-285

Oct 1, 2026 2:45 AM Weaknesses updated View changes

Type	Values Removed	Values Added
Weaknesses	CWE-264 CWE-285

Sep 30, 2026 5:45 PM Description updated. Added references View changes

Type	Values Removed	Values Added
Description	Sandbox escape in the Graphics component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.	Sandbox escape in the Graphics component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.
References		https://www.mozilla.org/security/advisories/mfsa2026-102/ https://www.mozilla.org/security/advisories/mfsa2026-103/

Sep 30, 2026 5:30 PM Description updated. Added references View changes

Type	Values Removed	Values Added
Description	Sandbox escape in the Graphics component. This vulnerability was fixed in Firefox ESR 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.	Sandbox escape in the Graphics component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.
References		https://www.mozilla.org/security/advisories/mfsa2026-101/

Sep 30, 2026 7:15 AM Weaknesses updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-264 CWE-285

Sep 30, 2026 4:15 AM Weaknesses updated View changes

Type	Values Removed	Values Added
Weaknesses	CWE-264 CWE-285

Sep 29, 2026 4:45 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Mozilla Mozilla firefox
Vendors & Products		Mozilla Mozilla firefox

Sep 29, 2026 4:15 PM Weaknesses updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-264 CWE-285

Sep 29, 2026 1:15 PM Description updated. Title updated. Added references View changes

Type	Values Removed	Values Added
Description		Sandbox escape in the Graphics component. This vulnerability was fixed in Firefox ESR 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.
Title		Sandbox escape in the Graphics component
References		https://bugzilla.mozilla.org/show_bug.cgi?id=2068367 https://www.mozilla.org/security/advisories/mfsa2026-100/ https://www.mozilla.org/security/advisories/mfsa2026-97/ https://www.mozilla.org/security/advisories/mfsa2026-98/ https://www.mozilla.org/security/advisories/mfsa2026-99/