CVE-2026-100781

Analyzed Analyzed - Analysis Complete

WebRender Sandbox Escape via Boundary Condition

Publication date: 2026-09-29

Last updated on: 2026-10-05

Assigner: Mozilla Corporation

Description

Sandbox escape due to incorrect boundary conditions in the Graphics: WebRender component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-29

Last Modified

2026-10-05

Generated

2026-10-19

AI Q&A

2026-09-29

EPSS Evaluated

2026-10-18

NVD

CVE-2026-100781

EUVD

EUVD-2026-88933

Affected Vendors & Products

Vendor	Product	Version / Range
mozilla	firefox	to 157.0.0 (exc)
mozilla	thunderbird	to 157.0 (exc)
mozilla	firefox	From 115.1.0 (inc) to 115.42.0 (exc)
mozilla	firefox	From 140.0 (inc) to 140.17.0 (exc)
mozilla	firefox	From 153.0 (inc) to 153.4.0 (exc)
mozilla	thunderbird	From 140.0 (inc) to 140.17.0 (exc)
mozilla	thunderbird	From 153.0 (inc) to 153.4.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-119	The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.

Attack-Flow Graph

Executive Summary

This vulnerability is a sandbox escape caused by incorrect boundary conditions in the Graphics: WebRender component of Firefox. It allows malicious code to break out of the browser's sandbox, potentially gaining unauthorized access to the host system.

Detection Guidance

This vulnerability is specific to Firefox's Graphics: WebRender component and requires checking the installed version of Firefox. Detection involves verifying if the affected versions are running and updating to patched versions (Firefox ESR 153.4, Firefox 157, Firefox ESR 115.42, or Firefox ESR 140.17).

Impact Analysis

If exploited, this vulnerability could allow attackers to run arbitrary code on your system, steal sensitive data, install malware, or perform other malicious actions. Users of affected Firefox versions are at risk until they update to the patched versions.

Compliance Impact

This vulnerability could lead to data breaches, which may violate GDPR, HIPAA, or other regulations requiring data protection. Organizations using affected Firefox versions may face compliance violations, fines, or legal consequences if exploited.

Mitigation Strategies

Update Firefox to a patched version: Firefox ESR 153.4, Firefox 157, Firefox ESR 115.42, or Firefox ESR 140.17 or later to address the sandbox escape vulnerability in Graphics: WebRender.

Hi! I’m here to help you understand CVE-2026-100781. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70