CVE-2026-100786
published 2026-09-29CVE-2026-100786: Sandbox escape due to use-after-free in the Graphics component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17…
PriorityP347critical9.6CVSS 3.1
AVNACLPRNUIRSCCHIHAH
EPSS
0.32%
23.3th percentile
Sandbox escape due to use-after-free in the Graphics component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.
Affected
15 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| mozilla | firefox | < Firefox 157 | Firefox 157 |
| mozilla | firefox | < 115.42.0 | 115.42.0 |
| mozilla | firefox | — | — |
| mozilla | firefox | >= 116.0 < 140.17.0 | 140.17.0 |
| mozilla | firefox | >= 141.0 < 153.4.0 | 153.4.0 |
| mozilla | firefox | >= 154.0.0 < 157.0.0 | 157.0.0 |
| mozilla | firefox_esr | < Firefox ESR 153.4 | Firefox ESR 153.4 |
| mozilla | firefox_esr | < Firefox ESR 140.17 | Firefox ESR 140.17 |
| mozilla | firefox_esr | < Firefox ESR 115.42 | Firefox ESR 115.42 |
| mozilla | thunderbird | < Thunderbird 157 | Thunderbird 157 |
| mozilla | thunderbird | < Thunderbird 140.17 | Thunderbird 140.17 |
| mozilla | thunderbird | < Thunderbird 153.4 | Thunderbird 153.4 |
| mozilla | thunderbird | < 140.17.0 | 140.17.0 |
| mozilla | thunderbird | >= 141.0 < 153.4.0 | 153.4.0 |
| mozilla | thunderbird | >= 154.0 < 157.0 | 157.0 |
CVSS provenance
nvdv3.19.6CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
vendor_redhat9.6CRITICAL
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
firefox: firefox: Sandbox escape via use-after-free in Graphics component
vendor_redhat·2026-09-29·CVSS 9.6
CVE-2026-100786 [CRITICAL] CWE-825 firefox: firefox: Sandbox escape via use-after-free in Graphics component
firefox: firefox: Sandbox escape via use-after-free in Graphics component
Sandbox escape due to use-after-free in the Graphics component. This vulnerability was fixed in Firefox ESR 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.
A flaw was found in Firefox. A use-after-free vulnerability in the Graphics component allows an attacker to escape the browser sandbox by enticing a user into processing specially crafted web content. Successful exploitation could allow an attacker to bypass security boundaries and execute arbitrary code on the host system.
Package: firefox (Red Hat Enterprise Linux 10) - Affected
Package: firefox (Red Hat Enterprise Linux 7) - Affected
Package: firefox (Red Hat Enterprise Linux 8) - Affected
Package: firefox (Red Hat Enterprise Linux 9) - Af
Mozilla
Mozilla Foundation Security Advisory 2026-101: CVE-2026-100786
vendor_mozilla·CVSS 9.6
CVE-2026-100786 [CRITICAL] Mozilla Foundation Security Advisory 2026-101: CVE-2026-100786
Mozilla Foundation Security Advisory 2026-101
CVE: CVE-2026-100786
Product: Thunderbird
Impact: low
Fixed in: Thunderbird 157
Mozilla
Mozilla Foundation Security Advisory 2026-97: CVE-2026-100786
vendor_mozilla·CVSS 9.6
CVE-2026-100786 [CRITICAL] Mozilla Foundation Security Advisory 2026-97: CVE-2026-100786
Mozilla Foundation Security Advisory 2026-97
CVE: CVE-2026-100786
Product: Firefox
Impact: low
Fixed in: Firefox 157
Mozilla
Mozilla Foundation Security Advisory 2026-100: CVE-2026-100786
vendor_mozilla·CVSS 9.6
CVE-2026-100786 [CRITICAL] Mozilla Foundation Security Advisory 2026-100: CVE-2026-100786
Mozilla Foundation Security Advisory 2026-100
CVE: CVE-2026-100786
Product: Firefox ESR
Impact: low
Fixed in: Firefox ESR 153.4
Mozilla
Mozilla Foundation Security Advisory 2026-99: CVE-2026-100786
vendor_mozilla·CVSS 9.6
CVE-2026-100786 [CRITICAL] Mozilla Foundation Security Advisory 2026-99: CVE-2026-100786
Mozilla Foundation Security Advisory 2026-99
CVE: CVE-2026-100786
Product: Firefox ESR
Impact: moderate
Fixed in: Firefox ESR 140.17
Mozilla
Mozilla Foundation Security Advisory 2026-102: CVE-2026-100786
vendor_mozilla·CVSS 9.6
CVE-2026-100786 [CRITICAL] Mozilla Foundation Security Advisory 2026-102: CVE-2026-100786
Mozilla Foundation Security Advisory 2026-102
CVE: CVE-2026-100786
Product: Thunderbird
Impact: moderate
Fixed in: Thunderbird 140.17
Mozilla
Mozilla Foundation Security Advisory 2026-103: CVE-2026-100786
vendor_mozilla·CVSS 9.6
CVE-2026-100786 [CRITICAL] Mozilla Foundation Security Advisory 2026-103: CVE-2026-100786
Mozilla Foundation Security Advisory 2026-103
CVE: CVE-2026-100786
Product: Thunderbird
Impact: low
Fixed in: Thunderbird 153.4
Mozilla
Mozilla Foundation Security Advisory 2026-98: CVE-2026-100786
vendor_mozilla·CVSS 9.6
CVE-2026-100786 [CRITICAL] Mozilla Foundation Security Advisory 2026-98: CVE-2026-100786
Mozilla Foundation Security Advisory 2026-98
CVE: CVE-2026-100786
Product: Firefox ESR
Impact: moderate
Fixed in: Firefox ESR 115.42
GHSA
Sandbox escape due to use-after-free in the Graphics component.
ghsa_unreviewed·2026-09-29
CVE-2026-100786 [CRITICAL] CWE-416 Sandbox escape due to use-after-free in the Graphics component.
Sandbox escape due to use-after-free in the Graphics component. This vulnerability was fixed in Firefox ESR 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.
No detection rules found.
No public exploits indexed.
https://bugzilla.mozilla.org/show_bug.cgi?id=2071067https://www.mozilla.org/security/advisories/mfsa2026-100/https://www.mozilla.org/security/advisories/mfsa2026-101/https://www.mozilla.org/security/advisories/mfsa2026-102/https://www.mozilla.org/security/advisories/mfsa2026-103/https://www.mozilla.org/security/advisories/mfsa2026-97/https://www.mozilla.org/security/advisories/mfsa2026-98/https://www.mozilla.org/security/advisories/mfsa2026-99/
2026-09-29
Published