Threat database

CVE-2026-100782 is a high-severity privilege escalation vulnerability in Mozilla Firefox and Thunderbird caused by incorrect boundary conditions in the Graphics component. The issue allows an attacker to escalate privileges due to improper handling of memory boundaries. Mozilla has fixed this vulnerability in multiple versions of Firefox and Thunderbird, including Firefox ESR 153.4, Firefox 157, and Thunderbird 157 among others.

CVE-2026-100781 is a critical sandbox escape vulnerability in Mozilla Firefox's Graphics: WebRender component caused by incorrect boundary conditions. It allows an attacker to potentially escape the sandbox environment, impacting confidentiality, integrity, and availability. The issue has been fixed in multiple Firefox and Thunderbird versions including Firefox ESR 153.4 and Firefox 157.

CVE-2026-100780 is a use-after-free vulnerability in the DOM: Core & HTML component of Mozilla Firefox and Thunderbird. It was addressed by Mozilla in Firefox ESR 153.4, Firefox 157, Firefox ESR 115.42, Firefox ESR 140.17, Thunderbird 140.17, Thunderbird 153.4, and Thunderbird 157. The vulnerability allows for potential high impact on confidentiality, integrity, and availability if exploited.

A use-after-free vulnerability exists in the XSLT component of Mozilla Firefox and Thunderbird. This flaw allows for potential remote code execution due to improper memory handling. The issue has been addressed and fixed in Firefox ESR 153.4, Firefox 157, Firefox ESR 115.42, Firefox ESR 140.17, Thunderbird 157, Thunderbird 140.17, and Thunderbird 153.4.

CVE-2026-100778 is a critical use-after-free vulnerability in the DOM: Core & HTML component of Mozilla Firefox and Thunderbird. It allows sandbox escape, potentially leading to complete compromise of confidentiality, integrity, and availability. The issue is fixed in Firefox ESR 153.4, Firefox 157, Firefox ESR 115.42, Firefox ESR 140.17, Thunderbird 157, Thunderbird 140.17, and Thunderbird 153.4.

CVE-2026-100777 is a use-after-free vulnerability in the Graphics: Canvas2D component of Mozilla Firefox and Thunderbird. It allows for potential remote code execution or other impacts due to improper memory handling. The issue has been fixed in Firefox ESR 153.4, Firefox 157, Firefox ESR 115.42, Firefox ESR 140.17, Thunderbird 157, Thunderbird 140.17, and Thunderbird 153.4.

CVE-2026-100776 is a use-after-free vulnerability in the JavaScript WebAssembly component affecting Mozilla Thunderbird and Firefox. This flaw allows potential high-impact consequences including confidentiality, integrity, and availability compromises. The vulnerability has been fixed in Thunderbird versions 140.17, 153.4, and 157, as well as Firefox ESR 140.17, ESR 153.4, and Firefox 157.

CVE-2026-100775 is a critical sandbox escape vulnerability in the Graphics component of Mozilla Firefox and Thunderbird. It allows an attacker to bypass sandbox restrictions, potentially leading to full system compromise. The vulnerability has been fixed in multiple versions of Firefox ESR, Firefox, and Thunderbird.

CVE-2026-100774 is a use-after-free vulnerability in the DOM: Core & HTML component of Mozilla Firefox and Thunderbird. It allows for potential remote code execution due to improper memory handling. The vulnerability has been fixed in Firefox ESR 153.4, Firefox 157, Firefox ESR 115.42, Firefox ESR 140.17, Thunderbird 157, Thunderbird 140.17, and Thunderbird 153.4. The CVSS score is 8.8, indicating high severity.

A use-after-free vulnerability exists in the Storage: IndexedDB component of Mozilla Firefox and Thunderbird. This vulnerability allows for potential high impact on confidentiality, integrity, and availability. It was fixed in Firefox ESR 153.4, Firefox 157, Firefox ESR 115.42, Firefox ESR 140.17, Thunderbird 157, Thunderbird 140.17, and Thunderbird 153.4.

CVE-2026-100772 is a use-after-free vulnerability in the DOM: Core & HTML component affecting Mozilla Thunderbird and Firefox. This flaw allows for potentially high impact attacks including confidentiality, integrity, and availability compromises. The issue has been fixed in Thunderbird versions 140.17, 153.4, and 157, as well as Firefox ESR 140.17, ESR 153.4, and Firefox 157.

CVE-2026-100771 is a high severity vulnerability in Mozilla Firefox and Thunderbird involving undefined behavior in the DOM Streams component. This issue affects multiple versions of Firefox and Thunderbird prior to their respective fixed releases. The vulnerability was addressed in Firefox ESR 153.4, Firefox 157, Firefox ESR 115.42, Firefox ESR 140.17, Thunderbird 140.17, Thunderbird 153.4, and Thunderbird 157.

CVE-2026-100770 is a critical use-after-free vulnerability in the DOM Content Processes component of Mozilla Firefox that allows sandbox escape. This flaw was addressed and fixed in multiple Mozilla products including Firefox ESR 153.4, Firefox 157, and Thunderbird versions 140.17, 153.4, and 157. The vulnerability has a high CVSS score of 9.6, indicating severe impact on confidentiality, integrity, and availability.

Use-after-free in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, and Firefox ESR 140.17.

CVE-2026-100768 is a use-after-free vulnerability in the Graphics: WebGPU component of Mozilla Thunderbird. This flaw allows for potential memory corruption leading to high impact on confidentiality, integrity, and availability. The issue was fixed in Thunderbird version 157.

CVE-2026-100767 is a use-after-free vulnerability in the Networking: Cache component of Mozilla Firefox and Thunderbird. This vulnerability allows for potential remote code execution or other impacts due to improper memory handling. It affects multiple versions of Firefox and Thunderbird prior to their respective fixed releases. The vulnerability has a high severity score of 8.8 and was fixed in Firefox ESR 153.4, Firefox 157, Firefox ESR 115.42, Firefox ESR 140.17, Thunderbird 157, Thunderbird 140.17, and Thunderbird 153.4.

CVE-2026-100765 is a use-after-free vulnerability in the JavaScript WebAssembly component of Mozilla Firefox. This flaw allows for potential high impact on confidentiality, integrity, and availability. The issue was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157.

CVE-2026-100764 is a high-severity privilege escalation vulnerability in Mozilla Thunderbird caused by incorrect boundary conditions in the Graphics: WebGPU component. The flaw allows an attacker to escalate privileges. This vulnerability was fixed in Thunderbird version 157.

CVE-2026-100763 is a critical vulnerability in Mozilla Thunderbird's Graphics: WebGPU component caused by incorrect boundary conditions. It allows an attacker to cause a denial of service and potentially impact confidentiality. The vulnerability was fixed in Thunderbird version 157.

CVE-2026-100762 is a critical use-after-free vulnerability in the DOM Content Processes component of Mozilla Firefox and Thunderbird. It allows sandbox escape, potentially leading to complete compromise of confidentiality, integrity, and availability. The issue is fixed in Firefox ESR 153.4, Firefox 157, Firefox ESR 115.42, Firefox ESR 140.17, Thunderbird 157, Thunderbird 140.17, and Thunderbird 153.4.