--- id: CVE-2026-100780 title: 'Use-after-free in the DOM: Core & HTML component' summary: >- Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17. severity: high cvss: 8.8 cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H' cwe: - CWE-416 vendor: mozilla product: firefox affected: - firefox < 157.0.0 - 'firefox >= 115.1.0, < 115.42.0' - 'firefox >= 140.0, < 140.17.0' - 'firefox >= 153.0, < 153.4.0' - thunderbird < 157.0 - 'thunderbird >= 140.0, < 140.17.0' - 'thunderbird >= 153.0, < 153.4.0' patched: - firefox 153.4.0 - thunderbird 153.4.0 published: '2026-09-29' updated: '2026-10-05' sourceUpdated: '2026-10-05T15:12:38.403' source: NVD sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-100780' references: - url: 'https://bugzilla.mozilla.org/show_bug.cgi?id=2068422' label: security@mozilla.org - url: 'https://www.mozilla.org/security/advisories/mfsa2026-100/' label: security@mozilla.org - url: 'https://www.mozilla.org/security/advisories/mfsa2026-101/' label: security@mozilla.org - url: 'https://www.mozilla.org/security/advisories/mfsa2026-102/' label: security@mozilla.org - url: 'https://www.mozilla.org/security/advisories/mfsa2026-103/' label: security@mozilla.org - url: 'https://www.mozilla.org/security/advisories/mfsa2026-97/' label: security@mozilla.org - url: 'https://www.mozilla.org/security/advisories/mfsa2026-98/' label: security@mozilla.org - url: 'https://www.mozilla.org/security/advisories/mfsa2026-99/' label: security@mozilla.org - url: >- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-100780.json - url: 'https://access.redhat.com/security/cve/CVE-2026-100780' - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2543187' - url: 'https://www.cve.org/CVERecord?id=CVE-2026-100780' - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-100780' - url: 'https://www.mozilla.org/security/advisories/mfsa2026-102/#CVE-2026-100780' - url: 'https://www.mozilla.org/security/advisories/mfsa2026-99/#CVE-2026-100780' - url: 'https://access.redhat.com/errata/RHSA-2026:85240' - url: 'https://access.redhat.com/errata/RHSA-2026:76764' - url: 'https://access.redhat.com/errata/RHSA-2026:80674' - url: 'https://access.redhat.com/errata/RHSA-2026:76850' - url: 'https://access.redhat.com/errata/RHSA-2026:85243' - url: 'https://access.redhat.com/errata/RHSA-2026:85242' - url: 'https://access.redhat.com/errata/RHSA-2026:85241' - url: 'https://access.redhat.com/errata/RHSA-2026:85244' - url: 'https://access.redhat.com/errata/RHSA-2026:76761' - url: 'https://access.redhat.com/errata/RHSA-2026:80694' tags: - nvd - cve.org - csaf - vex - red-hat epss: 0.00319 epssPercentile: 0.24749 ssvc: exploitation: none automatable: 'no' technicalImpact: total timestamp: '2026-09-29T14:38:25.673149Z' ingestedAt: '2026-09-29T13:34:31.662Z' scores: nvd: 8.8 vendor: 7.5 --- ## Overview Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17. ## Affected - `firefox < 157.0.0` - `firefox >= 115.1.0, < 115.42.0` - `firefox >= 140.0, < 140.17.0` - `firefox >= 153.0, < 153.4.0` - `thunderbird < 157.0` - `thunderbird >= 140.0, < 140.17.0` - `thunderbird >= 153.0, < 153.4.0` ## Remediation Upgrade past the affected range: - `firefox 153.4.0` - `thunderbird 153.4.0` ## Vendor advisories - **Red Hat VEX** · Important · affected: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8 · no fix planned: Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 8 · updated 2026-10-23 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-100780.json) - **RHSA-2026:85240** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream EUS (v. 10.0) · released 2026-10-19 · [advisory](https://access.redhat.com/errata/RHSA-2026:85240) - **RHSA-2026:76764** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 10) · released 2026-10-06 · [advisory](https://access.redhat.com/errata/RHSA-2026:76764) - **RHSA-2026:80674** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 10) · released 2026-10-12 · [advisory](https://access.redhat.com/errata/RHSA-2026:80674) - **RHSA-2026:76850** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 8) · released 2026-10-06 · [advisory](https://access.redhat.com/errata/RHSA-2026:76850) - **RHSA-2026:85243** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream AUS (v.8.4), Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4) · released 2026-10-19 · [advisory](https://access.redhat.com/errata/RHSA-2026:85243) - **RHSA-2026:85242** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream E4S (v.9.2) · released 2026-10-19 · [advisory](https://access.redhat.com/errata/RHSA-2026:85242) - **RHSA-2026:85241** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream E4S (v.9.4) · released 2026-10-19 · [advisory](https://access.redhat.com/errata/RHSA-2026:85241) - **RHSA-2026:85244** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream EUS (v.9.6) · released 2026-10-19 · [advisory](https://access.redhat.com/errata/RHSA-2026:85244) - **RHSA-2026:76761** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 9) · released 2026-10-08 · [advisory](https://access.redhat.com/errata/RHSA-2026:76761) - **RHSA-2026:80694** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 9) · released 2026-10-12 · [advisory](https://access.redhat.com/errata/RHSA-2026:80694)