Information disclosure in the Networking: JAR component. (CVE-2026-100766)
CVE-2026-100766 is an information disclosure vulnerability in the Networking: JAR component of Firefox. The issue allows unauthorized disclosure of information. This vulnerability has been fixed in Firefox ESR 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17. The CVSS v3.1 base score is 4.3, indicating a medium severity level.
AI Analysis
Technical Summary
This vulnerability involves information disclosure in the Networking: JAR component of Firefox. It was reported by Mozilla and assigned CVE-2026-100766. The flaw could allow an attacker to gain access to information that should otherwise be protected. Mozilla fixed this issue in Firefox ESR 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17. The CVSS vector indicates the vulnerability is remotely exploitable with low complexity, no privileges required, and requires user interaction, resulting in limited confidentiality impact without affecting integrity or availability.
Potential Impact
The vulnerability allows unauthorized disclosure of information via the Networking: JAR component. The impact is limited to confidentiality loss with no impact on integrity or availability. The CVSS score of 4.3 reflects a medium severity level, indicating moderate risk to affected users if exploited.
Mitigation Recommendations
A fix is available and has been released by Mozilla. Users and administrators should update to Firefox ESR 153.4, Firefox 157, Firefox ESR 115.42, or Firefox ESR 140.17 or later to remediate this vulnerability. No additional mitigation steps are required beyond applying the official update.
Information disclosure in the Networking: JAR component. (CVE-2026-100766)
Description
CVE-2026-100766 is an information disclosure vulnerability in the Networking: JAR component of Firefox. The issue allows unauthorized disclosure of information. This vulnerability has been fixed in Firefox ESR 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17. The CVSS v3.1 base score is 4.3, indicating a medium severity level.
CVSS v3.1
Score 4.3medium
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability involves information disclosure in the Networking: JAR component of Firefox. It was reported by Mozilla and assigned CVE-2026-100766. The flaw could allow an attacker to gain access to information that should otherwise be protected. Mozilla fixed this issue in Firefox ESR 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17. The CVSS vector indicates the vulnerability is remotely exploitable with low complexity, no privileges required, and requires user interaction, resulting in limited confidentiality impact without affecting integrity or availability.
Potential Impact
The vulnerability allows unauthorized disclosure of information via the Networking: JAR component. The impact is limited to confidentiality loss with no impact on integrity or availability. The CVSS score of 4.3 reflects a medium severity level, indicating moderate risk to affected users if exploited.
Mitigation Recommendations
A fix is available and has been released by Mozilla. Users and administrators should update to Firefox ESR 153.4, Firefox 157, Firefox ESR 115.42, or Firefox ESR 140.17 or later to remediate this vulnerability. No additional mitigation steps are required beyond applying the official update.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-pfpg-9xj2-7x85
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-100766"]
- Database Specific Severity
- MODERATE
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6abc27c9680226ef6846f846
Added to database: 09/29/2026, 21:04:09 UTC
Last enriched: 09/29/2026, 21:20:47 UTC
Last updated: 09/30/2026, 03:38:54 UTC
Views: 7
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.