Description
Sandbox escape in the Graphics component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.
Published: 2026-09-29
Score: 9.6 Critical
EPSS: < 1% Very Low
KEV: No
Impact: Sandbox escape allowing code execution
Action: Immediate Patch
AI Analysis

Impact

The flaw lies in the graphics component of Mozilla applications and permits a process to escape the confines of its sandbox during rendering. Inadequate enforcement of sandbox boundaries can enable the process to execute code with higher privileges than the sandbox permits, thereby potentially compromising both the application and the underlying system. The weakness is identified as CWE‑693 (Improper Handling of Error Conditions).

Affected Systems

Mozilla Firefox and Mozilla Thunderbird are affected. The vulnerability is fixed in Firefox ESR releases 115.42, 140.17, and 153.4, as well as in Firefox 157; and in Thunderbird releases 140.17, 153.4, and 157. Versions older than those releases remain vulnerable.

Risk and Exploitability

The EPSS score of less than 1 % indicates a low probability of exploitation in the wild, but the CVSS score of 9.6 categorizes the vulnerability as critical. The flaw is not listed in CISA’s KEV catalog and currently no public exploits are known. The likely attack vector is inferred to involve content that triggers the graphics subsystem—such as a malicious web page, document, or plugin—because the vulnerability arises when graphics rendering occurs.

Generated by OpenCVE AI on October 1, 2026 at 22:12 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade to a patched release of Firefox or Thunderbird—at least Firefox ESR 115.42, ESR 140.17, ESR 153.4, or Firefox 157, and Thunderbird 140.17, 153.4, or 157.
  • If an update cannot be applied immediately, disable or severely limit the graphics component’s exposure to untrusted content—for example, suppress native canvas operations or block plugins that use the graphics subsystem.
  • Maintain a subscription to Mozilla security advisories and monitor for emerging exploits to apply additional mitigations as they become available.

Generated by OpenCVE AI on October 1, 2026 at 22:12 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DLA Debian DLA DLA-4810-1 thunderbird security update
Debian DLA Debian DLA DLA-4814-1 firefox-esr security update
Debian DSA Debian DSA DSA-6533-1 firefox-esr security update
Debian DSA Debian DSA DSA-6536-1 thunderbird security update
History

Tue, 06 Oct 2026 14:45:00 +0000

Type Values Removed Values Added
First Time appeared Mozilla thunderbird
CPEs cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*
Vendors & Products Mozilla thunderbird

Thu, 01 Oct 2026 20:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-284
CWE-285

Thu, 01 Oct 2026 17:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Thu, 01 Oct 2026 16:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-693
Metrics cvssV3_1

{'score': 9.6, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H'}

Thu, 01 Oct 2026 05:00:00 +0000

Type Values Removed Values Added
Weaknesses CWE-284
CWE-285

Thu, 01 Oct 2026 02:45:00 +0000

Type Values Removed Values Added
Weaknesses CWE-264
CWE-285

Wed, 30 Sep 2026 17:45:00 +0000

Type Values Removed Values Added
Description Sandbox escape in the Graphics component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17. Sandbox escape in the Graphics component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.
References

Wed, 30 Sep 2026 17:30:00 +0000

Type Values Removed Values Added
Description Sandbox escape in the Graphics component. This vulnerability was fixed in Firefox ESR 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17. Sandbox escape in the Graphics component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.
References

Wed, 30 Sep 2026 07:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-264
CWE-285

Wed, 30 Sep 2026 04:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-264
CWE-285

Tue, 29 Sep 2026 16:45:00 +0000

Type Values Removed Values Added
First Time appeared Mozilla
Mozilla firefox
Vendors & Products Mozilla
Mozilla firefox

Tue, 29 Sep 2026 16:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-264
CWE-285

Tue, 29 Sep 2026 13:15:00 +0000

Type Values Removed Values Added
Description Sandbox escape in the Graphics component. This vulnerability was fixed in Firefox ESR 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.
Title Sandbox escape in the Graphics component
References

Subscriptions

Mozilla Firefox Thunderbird
cve-icon MITRE

Status: PUBLISHED

Assigner: mozilla

Published:

Updated: 2026-10-01T15:36:07.564Z

Reserved: 2026-09-26T19:15:31.053Z

Link: CVE-2026-100775

cve-icon Vulnrichment

Updated: 2026-10-01T15:35:28.426Z

cve-icon NVD

Status : Analyzed

Published: 2026-09-29T13:17:42.083

Modified: 2026-10-06T14:36:05.190

Link: CVE-2026-100775

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-01T22:15:13Z

Weaknesses
  • CWE-693

    Protection Mechanism Failure