October 5, 2026

CVE Watchtower

← Back to CVE List

CVE-2026-100786NVD

Vulnerability Summary

Sandbox escape due to use-after-free in the Graphics component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.
Severity Level
CRITICAL(9.6)
Published Date
Sep 29, 2026
Last Modified
Oct 5, 2026
Exploitation Status
No confirmed exploitation yet
EPSS Score (30-Day)
0.34%Probability
Root Weakness (CWE)
CWE-416: Unknown/Unlisted Weakness ↗
Refer to the official MITRE database for detailed architectural specifications regarding this weakness.
CVSS v3.1 Base Metrics — Score 9.6 (CRITICAL)
Attack VectorNetwork
Attack ComplexityLow
Privileges RequiredNone
User InteractionRequired
ScopeChanged
ConfidentialityHigh
IntegrityHigh
AvailabilityHigh

Affected & Patched Versions

Affected Versions
  • Mozilla Firefox < 115.42.0
  • Mozilla Firefox >= 116.0 and < 140.17.0
  • Mozilla Firefox >= 141.0 and < 153.4.0
  • Mozilla Firefox >= 154.0.0 and < 157.0.0
  • Mozilla Thunderbird < 140.17.0
  • Mozilla Thunderbird >= 141.0 and < 153.4.0
  • Mozilla Thunderbird >= 154.0 and < 157.0
Patched Versions
  • Mozilla Firefox 115.42.0
  • Mozilla Firefox 140.17.0
  • Mozilla Firefox 153.4.0
  • Mozilla Firefox 157.0.0
  • Mozilla Thunderbird 140.17.0
  • Mozilla Thunderbird 153.4.0
  • Mozilla Thunderbird 157.0
🎁7-Day Free Trial — Try Pro or Team, no card required.
📧Email Delivery — Threat intel straight to your inbox.
♾️Unlimited Vendors — Track your entire stack.
🚨All New CVEs — Be the first to know.
📈EPSS Spike Alerts — Catch rising risk before it peaks.
🎯Custom EPSS/CVSS — Filter noise, focus on risk.
🛡️Exploit Intel — A 2nd confirmed-exploit signal beyond KEV.
🐙GitHub Issues — Auto-tracked, no duplicates.
📬Weekly Digest — One clean summary, not inbox spam.
🏷️Watchlist Groups — Tag alerts by team (Infra/AppSec/SOC).
💬Webhooks — Slack & Teams integration.
🔀Smart Routing — Critical alerts to one channel, rest to another.
🚫Ad-Free — Uninterrupted experience.
🎁7-Day Free Trial — Try Pro or Team, no card required.
📧Email Delivery — Threat intel straight to your inbox.
♾️Unlimited Vendors — Track your entire stack.
🚨All New CVEs — Be the first to know.
📈EPSS Spike Alerts — Catch rising risk before it peaks.
🎯Custom EPSS/CVSS — Filter noise, focus on risk.
🛡️Exploit Intel — A 2nd confirmed-exploit signal beyond KEV.
🐙GitHub Issues — Auto-tracked, no duplicates.
📬Weekly Digest — One clean summary, not inbox spam.
🏷️Watchlist Groups — Tag alerts by team (Infra/AppSec/SOC).
💬Webhooks — Slack & Teams integration.
🔀Smart Routing — Critical alerts to one channel, rest to another.
🚫Ad-Free — Uninterrupted experience.

External References