--- id: CVE-2026-100807 title: 'Privilege escalation in the DOM: Service Workers component' summary: >- Privilege escalation in the DOM: Service Workers component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, and Firefox ESR 140.17. severity: high cvss: 8.8 cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H' cwe: - CWE-269 vendor: Mozilla product: Firefox affected: - Firefox published: '2026-09-29' updated: '2026-09-30' sourceUpdated: '2026-09-30T18:18:10.137' source: NVD sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-100807' references: - url: 'https://bugzilla.mozilla.org/show_bug.cgi?id=2062740' label: security@mozilla.org - url: 'https://www.mozilla.org/security/advisories/mfsa2026-100/' label: security@mozilla.org - url: 'https://www.mozilla.org/security/advisories/mfsa2026-101/' label: security@mozilla.org - url: 'https://www.mozilla.org/security/advisories/mfsa2026-102/' label: security@mozilla.org - url: 'https://www.mozilla.org/security/advisories/mfsa2026-103/' label: security@mozilla.org - url: 'https://www.mozilla.org/security/advisories/mfsa2026-97/' label: security@mozilla.org - url: 'https://www.mozilla.org/security/advisories/mfsa2026-99/' label: security@mozilla.org - url: >- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-100807.json - url: 'https://access.redhat.com/security/cve/CVE-2026-100807' - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2543130' - url: 'https://www.cve.org/CVERecord?id=CVE-2026-100807' - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-100807' - url: 'https://www.mozilla.org/security/advisories/mfsa2026-102/#CVE-2026-100807' - url: 'https://www.mozilla.org/security/advisories/mfsa2026-99/#CVE-2026-100807' - url: 'https://access.redhat.com/errata/RHSA-2026:85240' - url: 'https://access.redhat.com/errata/RHSA-2026:76764' - url: 'https://access.redhat.com/errata/RHSA-2026:80674' - url: 'https://access.redhat.com/errata/RHSA-2026:76850' - url: 'https://access.redhat.com/errata/RHSA-2026:85243' - url: 'https://access.redhat.com/errata/RHSA-2026:85242' - url: 'https://access.redhat.com/errata/RHSA-2026:85241' - url: 'https://access.redhat.com/errata/RHSA-2026:85244' - url: 'https://access.redhat.com/errata/RHSA-2026:76761' - url: 'https://access.redhat.com/errata/RHSA-2026:80694' tags: - nvd - cve.org - csaf - vex - red-hat - score-dispute epss: 0.00234 epssPercentile: 0.14182 ssvc: exploitation: none automatable: 'no' technicalImpact: total timestamp: '2026-09-29T13:24:10.288546Z' ingestedAt: '2026-09-29T13:34:31.671Z' scores: nvd: 8.8 vendor: 6.1 patched: - enterprise_linux_appstream_eus_v_10_0 - enterprise_linux_appstream_v_10 - enterprise_linux_appstream_v_8 - enterprise_linux_appstream_aus_v_8_4 - enterprise_linux_appstream_eus_extension_v_8_4 - enterprise_linux_appstream_e4s_v_9_2 - enterprise_linux_appstream_e4s_v_9_4 - enterprise_linux_appstream_eus_v_9_6 - enterprise_linux_appstream_v_9 --- ## Overview Privilege escalation in the DOM: Service Workers component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, and Firefox ESR 140.17. ## Remediation Refer to the linked advisories for vendor-supplied fixes and affected version ranges. ## Vendor advisories - **Red Hat VEX** · Moderate · affected: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8 · no fix planned: Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 8 · updated 2026-10-23 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-100807.json) - **RHSA-2026:85240** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream EUS (v. 10.0) · released 2026-10-19 · [advisory](https://access.redhat.com/errata/RHSA-2026:85240) - **RHSA-2026:76764** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 10) · released 2026-10-06 · [advisory](https://access.redhat.com/errata/RHSA-2026:76764) - **RHSA-2026:80674** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 10) · released 2026-10-12 · [advisory](https://access.redhat.com/errata/RHSA-2026:80674) - **RHSA-2026:76850** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 8) · released 2026-10-06 · [advisory](https://access.redhat.com/errata/RHSA-2026:76850) - **RHSA-2026:85243** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream AUS (v.8.4), Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4) · released 2026-10-19 · [advisory](https://access.redhat.com/errata/RHSA-2026:85243) - **RHSA-2026:85242** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream E4S (v.9.2) · released 2026-10-19 · [advisory](https://access.redhat.com/errata/RHSA-2026:85242) - **RHSA-2026:85241** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream E4S (v.9.4) · released 2026-10-19 · [advisory](https://access.redhat.com/errata/RHSA-2026:85241) - **RHSA-2026:85244** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream EUS (v.9.6) · released 2026-10-19 · [advisory](https://access.redhat.com/errata/RHSA-2026:85244) - **RHSA-2026:76761** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 9) · released 2026-10-08 · [advisory](https://access.redhat.com/errata/RHSA-2026:76761) - **RHSA-2026:80694** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 9) · released 2026-10-12 · [advisory](https://access.redhat.com/errata/RHSA-2026:80694)