firefox security update (CVE-2026-100760)

This security update addresses numerous critical vulnerabilities in Mozilla Firefox, fixed in Firefox ESR 153.4 and Firefox 157. Key issues include sandbox escapes in the process sandboxing, XUL, and Disability Access APIs components; use-after-free vulnerabilities in the JavaScript WebAssembly and JIT engines, and CSS parsing; cryptography misuse in the Storage Quota Manager; mitigation bypasses in DOM components including Service Workers, Security, Navigation, and Bookmarks & History; same-origin policy bypass in DevTools; denial-of-service flaws in graphics and storage components; spoofing in HTTP networking; and privilege escalation in the Places component. Exploitation could lead to arbitrary code execution, privilege escalation, security mitigation bypass, or denial of service. The update is a comprehensive security fix for multiple attack vectors within Firefox and Thunderbird.

The vulnerabilities collectively allow remote attackers to bypass sandbox restrictions, execute arbitrary code, escalate privileges, bypass security mitigations, cause denial of service, and spoof network communications. The critical CVSS score of 10.0 reflects the potential for complete compromise of the affected browsers if exploited. These flaws affect core browser components responsible for security isolation, memory safety, cryptographic operations, and network security.

A security update fixing all listed vulnerabilities is available in Firefox ESR 153.4 and Firefox 157. Users and administrators should apply these official patches promptly to mitigate the risks. No additional mitigation actions are indicated beyond updating to the fixed versions.