Threat database

CVE-2026-100804 is a critical use-after-free vulnerability in the Preferences: Backend component of Mozilla Thunderbird that allows sandbox escape. This flaw was fixed in Thunderbird version 157. The vulnerability has a high CVSS score of 9.6, indicating severe impact on confidentiality, integrity, and availability. No known exploits are reported in the wild. Users should upgrade to Thunderbird 157 or later to remediate this issue.

CVE-2026-100803 is a high-severity vulnerability in Mozilla Firefox involving a same-origin policy bypass in the WebExtensions component. This flaw allows an attacker to bypass security restrictions that normally prevent web content from accessing data from other origins. The issue has been fixed in multiple Mozilla products including Firefox ESR 153.4, Firefox 157, Thunderbird 140.17, 153.4, and 157, as well as Firefox ESR 115.42 and 140.17.

CVE-2026-100801 is a high-severity privilege escalation vulnerability in the DLL Services component of Mozilla Thunderbird. It allows unauthorized privilege escalation and affects multiple Thunderbird versions prior to 153.4, 157, and 140.17. The issue has been fixed in Thunderbird versions 153.4, 157, and 140.17, as well as corresponding Firefox versions.

CVE-2026-100800 is a critical use-after-free vulnerability in the Disability Access APIs component of Mozilla Firefox that allows sandbox escape. This flaw was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157. The vulnerability has a high CVSS score of 9.6, indicating severe impact on confidentiality, integrity, and availability. No known exploits are reported in the wild at this time.

CVE-2026-100798 is a cryptography misuse vulnerability in the Storage: Quota Manager component of Mozilla Firefox. It affects Firefox versions prior to 153.4 and was fixed in Firefox ESR 153.4 and Firefox 157. The vulnerability has a high severity rating with a CVSS score of 8.1. No known exploits are reported in the wild. The issue also affects Thunderbird versions prior to 157 and 153.4, which were similarly fixed. This vulnerability could allow an attacker to compromise confidentiality and integrity without requiring privileges or authentication, but user interaction is required.

CVE-2026-100797 is a high-severity privilege escalation vulnerability in Mozilla Firefox caused by a use-after-free flaw in the Graphics: WebRender component. This issue allows an attacker to escalate privileges by exploiting memory corruption. The vulnerability has been fixed in multiple Mozilla products, including Firefox ESR 153.4, Firefox 157, and Thunderbird versions 140.17, 153.4, and 157.

CVE-2026-100796 is a use-after-free vulnerability in the JavaScript WebAssembly component of Mozilla Thunderbird. This flaw allows for potential high impact on confidentiality, integrity, and availability. The issue was fixed in Thunderbird version 157.

CVE-2026-100795 is a denial-of-service vulnerability in the networking component of Mozilla Thunderbird. The flaw allows an attacker to cause a denial of service, impacting availability. This vulnerability was fixed in Thunderbird version 157. No known exploits are reported in the wild.

CVE-2026-96869 is an information disclosure vulnerability in the Networking component of Mozilla Thunderbird. It allows unauthorized information exposure but does not impact integrity or availability. The issue has been fixed in Thunderbird versions 140.17, 153.4, and 157, as well as corresponding Firefox versions.

CVE-2026-100794 is a critical vulnerability in Mozilla Thunderbird involving a sandbox escape caused by incorrect boundary conditions in the Internationalization component. This flaw allows an attacker to bypass sandbox protections, potentially leading to full compromise of confidentiality, integrity, and availability. The issue has been fixed in Thunderbird versions 140.17, 153.4, and 157, as well as Firefox ESR 140.17, ESR 153.4, and Firefox 157.

CVE-2026-100793 is a vulnerability in Mozilla Thunderbird's JavaScript Engine component caused by JIT miscompilation. This flaw could lead to a confidentiality impact without affecting integrity or availability. The issue was fixed in Thunderbird version 157.

CVE-2026-100792 is a high-severity vulnerability in Mozilla Thunderbird involving a JIT miscompilation issue in the JavaScript WebAssembly component. This flaw could lead to high confidentiality impact and limited integrity impact without affecting availability. The vulnerability has been fixed in Thunderbird versions 140.17, 153.4, and 157, as well as corresponding Firefox versions. No known exploits are reported in the wild.

CVE-2026-100791 is a use-after-free vulnerability in the DOM: Core & HTML component of Mozilla Firefox and Thunderbird. This vulnerability allows for potential high impact on confidentiality, integrity, and availability. It was fixed in Firefox ESR 153.4, Firefox 157, Firefox ESR 115.42, Firefox ESR 140.17, Thunderbird 157, Thunderbird 140.17, and Thunderbird 153.4.

CVE-2026-100790 is a use-after-free vulnerability in the XSLT component of Mozilla Firefox and Thunderbird. This security flaw allows potential exploitation leading to high impact on confidentiality, integrity, and availability. The issue has been addressed and fixed in multiple versions of Firefox and Thunderbird, including Firefox ESR 153.4, Firefox 157, and Thunderbird 157 among others.

CVE-2026-100789 is a use-after-free vulnerability in the Graphics: Canvas2D component of Mozilla Firefox and Thunderbird. This vulnerability allows for potential remote code execution or denial of service. It has been fixed in multiple versions of Firefox and Thunderbird, including Firefox ESR 153.4, Firefox 157, and Thunderbird 157 among others. The vulnerability has a high severity score of 8.8 and requires user interaction for exploitation.

CVE-2026-100788 is a critical vulnerability in Mozilla Thunderbird involving an invalid pointer in the JavaScript WebAssembly component. This flaw allows for potential high impact on confidentiality, integrity, and availability. The issue has been fixed in multiple versions of Thunderbird and Firefox, including Thunderbird 157, 140.17, and 153.4. The vulnerability is tracked under CWE-824 and has a CVSS score of 9.8, indicating critical severity.

CVE-2026-100787 is a critical sandbox escape vulnerability in the XUL component of Mozilla Firefox. It allows an attacker to bypass sandbox restrictions, potentially leading to full system compromise. The vulnerability affects Firefox versions prior to 153.4 and was fixed in Firefox ESR 153.4, Firefox 157, Thunderbird 153.4, and Thunderbird 157.

CVE-2026-100786 is a critical use-after-free vulnerability in the Graphics component of Mozilla Firefox and Thunderbird that allows sandbox escape. It affects multiple versions of Firefox and Thunderbird prior to specific fixed releases. The vulnerability has been addressed in Firefox ESR 153.4, Firefox 157, Firefox ESR 115.42, Firefox ESR 140.17, Thunderbird 157, Thunderbird 140.17, and Thunderbird 153.4.

CVE-2026-100785 is a use-after-free vulnerability in the DOM: Core & HTML component of Mozilla Firefox and Thunderbird. This vulnerability allows for potential high impact on confidentiality, integrity, and availability. It has been fixed in Firefox ESR 153.4, Firefox 157, Firefox ESR 115.42, Firefox ESR 140.17, Thunderbird 157, Thunderbird 140.17, and Thunderbird 153.4.

CVE-2026-100784 is a use-after-free vulnerability in the Layout: Text and Fonts component of Mozilla Firefox and Thunderbird. It affects multiple versions of Firefox and Thunderbird prior to their respective fixed releases. The vulnerability has a high severity with a CVSS score of 8.8, indicating it can lead to significant confidentiality, integrity, and availability impacts. Mozilla has released official fixes in Firefox ESR 153.4, Firefox 157, Firefox ESR 115.42, Firefox ESR 140.17, Thunderbird 157, Thunderbird 140.17, and Thunderbird 153.4.