CVE-2026-100826

Analyzed Analyzed - Analysis Complete

Denial-of-Service in Firefox StorageManager

Publication date: 2026-09-29

Last updated on: 2026-10-13

Assigner: Mozilla Corporation

Description

Denial-of-service in the Storage: StorageManager component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-29

Last Modified

2026-10-13

Generated

2026-10-19

AI Q&A

2026-09-29

EPSS Evaluated

2026-10-18

NVD

CVE-2026-100826

EUVD

EUVD-2026-88805

Affected Vendors & Products

Vendor	Product	Version / Range
mozilla	firefox	to 153.4.0 (exc)
mozilla	firefox	From 154.0.0 (inc) to 157.0.0 (exc)
mozilla	thunderbird	to 153.4.0 (exc)
mozilla	thunderbird	From 154.0 (inc) to 157.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-770	The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

Attack-Flow Graph

Executive Summary

This is a denial-of-service vulnerability in Firefox's StorageManager component. It was patched in Firefox ESR 153.4 and Firefox 157. The issue allows attackers to crash the browser by exploiting flaws in storage management.

Detection Guidance

This vulnerability affects the Storage: StorageManager component in Firefox. Detection involves checking Firefox version and monitoring for crashes or unusual storage-related activity. Verify installed version with commands like 'firefox --version' or 'about:support' in Firefox. Look for repeated crashes or high memory usage in storage processes.

Impact Analysis

If exploited, this vulnerability could cause your Firefox browser to crash repeatedly, leading to loss of unsaved work and disruption of normal browsing activities. It does not appear to allow data theft or remote code execution.

Compliance Impact

This vulnerability is a denial-of-service issue in Firefox's StorageManager component. It does not directly impact compliance with GDPR or HIPAA as it does not involve unauthorized data access, disclosure, or processing. However, if the DoS disrupts critical services handling personal or health data, it could indirectly affect availability requirements under these regulations.

Mitigation Strategies

Update Firefox ESR to version 153.4 or later and Firefox to version 157 or later to address the Denial-of-service vulnerability in the Storage: StorageManager component.

Hi! I’m here to help you understand CVE-2026-100826. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70