CVE-2026-100801

Awaiting Analysis Awaiting Analysis - Queue

Privilege Escalation in Firefox ESR and Firefox

Publication date: 2026-09-29

Last updated on: 2026-09-30

Assigner: Mozilla Corporation

Description

Privilege escalation in the DLL Services component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, and Firefox ESR 140.17.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-29

Last Modified

2026-09-30

Generated

2026-10-19

AI Q&A

2026-09-29

EPSS Evaluated

2026-10-18

NVD

CVE-2026-100801

EUVD

EUVD-2026-88954

Affected Vendors & Products

Vendor	Product	Version / Range
mozilla	firefox	to 153.4 (inc)
mozilla	firefox	157
mozilla	firefox	140.17
mozilla	firefox	to 157 (inc)
mozilla	firefox	to 140.17 (inc)
mozilla	firefox	153.4

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-269	The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

Attack-Flow Graph

Executive Summary

This is a privilege escalation vulnerability in the DLL Services component of Firefox. It allows an attacker to gain higher privileges than intended, potentially leading to unauthorized access or control of the system.

Detection Guidance

This vulnerability is specific to Firefox and Firefox ESR versions before 153.4, 157, and 140.17. Detection involves checking installed Firefox versions. Use commands like 'firefox --version' or 'dpkg -l firefox' on Linux to verify versions. If outdated, update immediately.

Impact Analysis

An attacker could exploit this to run malicious code, install unauthorized software, or access sensitive data on your system. It may also allow them to bypass security controls.

Compliance Impact

This vulnerability could lead to unauthorized access to personal or sensitive data, violating GDPR and HIPAA requirements for data protection and access controls.

Mitigation Strategies

Update Firefox ESR to version 153.4 or later, Firefox to version 157 or later, or Firefox ESR to version 140.17 or later to address the privilege escalation in the DLL Services component.

Hi! I’m here to help you understand CVE-2026-100801. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70