CVE-2026-100758

Analyzed Analyzed - Analysis Complete

DOM Navigation Sandbox Escape in Firefox

Publication date: 2026-09-29

Last updated on: 2026-10-13

Assigner: Mozilla Corporation

Description

Sandbox escape in the DOM: Navigation component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-29

Last Modified

2026-10-13

Generated

2026-10-19

AI Q&A

2026-09-29

EPSS Evaluated

2026-10-18

NVD

CVE-2026-100758

EUVD

EUVD-2026-88910

Affected Vendors & Products

Vendor	Product	Version / Range
mozilla	firefox	From 154.0.0 (inc) to 157.0.0 (exc)
mozilla	thunderbird	From 154.0 (inc) to 157.0 (exc)
mozilla	firefox	to 115.42.0 (exc)
mozilla	thunderbird	to 140.17.0 (exc)
mozilla	thunderbird	From 141.0 (inc) to 153.4.0 (exc)
mozilla	firefox	From 116.0.0 (inc) to 140.17.0 (exc)
mozilla	firefox	From 141.0.0 (inc) to 153.4.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-284	The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

Attack-Flow Graph

Executive Summary

This is a sandbox escape vulnerability in Firefox's DOM Navigation component. It allows malicious code to break out of the browser's security sandbox, potentially gaining unauthorized access to system resources or other browser processes.

Detection Guidance

Detection requires checking Firefox version against patched releases. Use commands like 'firefox --version' or check package managers (e.g., 'apt list --installed | grep firefox' for Debian/Ubuntu). Compare versions against Firefox ESR 153.4, Firefox 157, Firefox ESR 115.42, or Firefox ESR 140.17.

Impact Analysis

If exploited, this vulnerability could allow attackers to execute arbitrary code on your system, steal sensitive data, install malware, or perform other malicious actions through a compromised browser session.

Compliance Impact

This vulnerability is a sandbox escape in the DOM Navigation component, which could allow unauthorized access to sensitive data or system resources. Such an issue may violate compliance requirements under GDPR (data protection) and HIPAA (health information security) by enabling data breaches or unauthorized access to protected information.

Mitigation Strategies

Update Firefox to the latest patched version immediately. For ESR users, upgrade to Firefox ESR 153.4 or 115.42. For standard releases, upgrade to Firefox 157 or ESR 140.17. Disable automatic updates temporarily if needed until patches are applied.

Hi! I’m here to help you understand CVE-2026-100758. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70