CVE-2026-100800

Awaiting Analysis Awaiting Analysis - Queue

Firefox Sandbox Escape via Use-After-Free in Disability Access APIs

Publication date: 2026-09-29

Last updated on: 2026-09-30

Assigner: Mozilla Corporation

Description

Sandbox escape due to use-after-free in the Disability Access APIs component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-29

Last Modified

2026-09-30

Generated

2026-10-19

AI Q&A

2026-09-29

EPSS Evaluated

2026-10-18

NVD

CVE-2026-100800

EUVD

EUVD-2026-88953

Affected Vendors & Products

Vendor	Product	Version / Range
mozilla	firefox	to 153.4 (inc)
mozilla	firefox	to 157 (inc)
mozilla	firefox	153.4
mozilla	firefox	157

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-416	The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

Attack-Flow Graph

Executive Summary

This is a sandbox escape vulnerability caused by a use-after-free error in the Disability Access APIs component of Firefox. A use-after-free occurs when a program continues to use a pointer after the memory it points to has been freed, potentially allowing an attacker to execute arbitrary code or escape the browser sandbox. The issue was patched in Firefox ESR 153.4 and Firefox 157.

Detection Guidance

This vulnerability is specific to Firefox and related to a sandbox escape via use-after-free in Disability Access APIs. Detection requires checking Firefox version and monitoring for unusual activity. Commands: Check Firefox version with 'firefox --version' or inspect installed packages. Monitor for crashes or unexpected behavior in sandboxed environments.

Impact Analysis

This vulnerability could allow an attacker to break out of the browser sandbox and execute malicious code on your system. If exploited, it may lead to unauthorized access to sensitive data, installation of malware, or further compromise of your device. Users running unpatched versions of Firefox are at risk.

Compliance Impact

The vulnerability involves a sandbox escape due to use-after-free in Disability Access APIs, which could allow arbitrary code execution. This could potentially lead to unauthorized access to sensitive data, impacting compliance with standards like GDPR (data protection) and HIPAA (health information privacy) by increasing the risk of data breaches or unauthorized disclosure.

Mitigation Strategies

Update Firefox ESR to version 153.4 or later and Firefox to version 157 or later to address the sandbox escape vulnerability.

Hi! I’m here to help you understand CVE-2026-100800. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70