CVE-2026-100774 is a use-after-free vulnerability affecting the DOM: Core & HTML component in Mozilla Firefox. Use-after-free vulnerabilities occur when a program continues to use a pointer after the memory it points to has been freed, potentially leading to memory corruption and security issues. This vulnerability was fixed in Firefox ESR 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17. The Mozilla advisory categorizes this and related vulnerabilities as high impact and provides patches in these versions. There are no reports of active exploitation in the wild for this specific CVE.

The vulnerability allows for use-after-free conditions in the DOM: Core & HTML component, which can result in memory corruption. This can potentially be leveraged to cause crashes or execute arbitrary code, representing a high security risk. However, no known exploits in the wild have been reported. The impact is rated high by Mozilla.

A fix is available and has been released in Firefox ESR 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17. Users and administrators should update affected Firefox installations to these versions or later to remediate this vulnerability. No additional mitigation steps are indicated by the vendor advisory.