--- id: CVE-2026-100819 title: Sandbox escape due to incorrect boundary conditions in the XPCOM component summary: >- Sandbox escape due to incorrect boundary conditions in the XPCOM component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17. severity: critical cvss: 9.6 cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H' cwe: - CWE-119 vendor: mozilla product: firefox affected: - firefox < 115.42.0 - 'firefox >= 116.0, < 140.17.0' - 'firefox >= 141.0, < 153.4.0' - 'firefox >= 154.0.0, < 157.0.0' - thunderbird < 140.17.0 - 'thunderbird >= 141.0, < 153.4.0' - 'thunderbird >= 154.0, < 157.0' patched: - firefox 157.0.0 - thunderbird 157.0 published: '2026-09-29' updated: '2026-10-05' sourceUpdated: '2026-10-05T14:07:09.417' source: NVD sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-100819' references: - url: 'https://bugzilla.mozilla.org/show_bug.cgi?id=2071069' label: security@mozilla.org - url: 'https://www.mozilla.org/security/advisories/mfsa2026-100/' label: security@mozilla.org - url: 'https://www.mozilla.org/security/advisories/mfsa2026-101/' label: security@mozilla.org - url: 'https://www.mozilla.org/security/advisories/mfsa2026-102/' label: security@mozilla.org - url: 'https://www.mozilla.org/security/advisories/mfsa2026-103/' label: security@mozilla.org - url: 'https://www.mozilla.org/security/advisories/mfsa2026-97/' label: security@mozilla.org - url: 'https://www.mozilla.org/security/advisories/mfsa2026-98/' label: security@mozilla.org - url: 'https://www.mozilla.org/security/advisories/mfsa2026-99/' label: security@mozilla.org - url: >- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-100819.json - url: 'https://access.redhat.com/security/cve/CVE-2026-100819' - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2543134' - url: 'https://www.cve.org/CVERecord?id=CVE-2026-100819' - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-100819' - url: 'https://www.mozilla.org/security/advisories/mfsa2026-102/#CVE-2026-100819' - url: 'https://www.mozilla.org/security/advisories/mfsa2026-99/#CVE-2026-100819' - url: 'https://access.redhat.com/errata/RHSA-2026:85240' - url: 'https://access.redhat.com/errata/RHSA-2026:76764' - url: 'https://access.redhat.com/errata/RHSA-2026:80674' - url: 'https://access.redhat.com/errata/RHSA-2026:76850' - url: 'https://access.redhat.com/errata/RHSA-2026:85243' - url: 'https://access.redhat.com/errata/RHSA-2026:85242' - url: 'https://access.redhat.com/errata/RHSA-2026:85241' - url: 'https://access.redhat.com/errata/RHSA-2026:85244' - url: 'https://access.redhat.com/errata/RHSA-2026:76761' - url: 'https://access.redhat.com/errata/RHSA-2026:80694' tags: - nvd - cve.org - csaf - vex - red-hat - score-dispute epss: 0.00264 epssPercentile: 0.18211 ssvc: exploitation: none automatable: 'no' technicalImpact: total timestamp: '2026-09-29T14:06:32.613912Z' ingestedAt: '2026-09-29T13:34:31.676Z' scores: nvd: 9.6 vendor: 6.1 --- ## Overview Sandbox escape due to incorrect boundary conditions in the XPCOM component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17. ## Affected - `firefox < 115.42.0` - `firefox >= 116.0, < 140.17.0` - `firefox >= 141.0, < 153.4.0` - `firefox >= 154.0.0, < 157.0.0` - `thunderbird < 140.17.0` - `thunderbird >= 141.0, < 153.4.0` - `thunderbird >= 154.0, < 157.0` ## Remediation Upgrade past the affected range: - `firefox 157.0.0` - `thunderbird 157.0` ## Vendor advisories - **Red Hat VEX** · Moderate · affected: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8 · no fix planned: Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 8 · updated 2026-10-23 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-100819.json) - **RHSA-2026:85240** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream EUS (v. 10.0) · released 2026-10-19 · [advisory](https://access.redhat.com/errata/RHSA-2026:85240) - **RHSA-2026:76764** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 10) · released 2026-10-06 · [advisory](https://access.redhat.com/errata/RHSA-2026:76764) - **RHSA-2026:80674** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 10) · released 2026-10-12 · [advisory](https://access.redhat.com/errata/RHSA-2026:80674) - **RHSA-2026:76850** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 8) · released 2026-10-06 · [advisory](https://access.redhat.com/errata/RHSA-2026:76850) - **RHSA-2026:85243** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream AUS (v.8.4), Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4) · released 2026-10-19 · [advisory](https://access.redhat.com/errata/RHSA-2026:85243) - **RHSA-2026:85242** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream E4S (v.9.2) · released 2026-10-19 · [advisory](https://access.redhat.com/errata/RHSA-2026:85242) - **RHSA-2026:85241** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream E4S (v.9.4) · released 2026-10-19 · [advisory](https://access.redhat.com/errata/RHSA-2026:85241) - **RHSA-2026:85244** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream EUS (v.9.6) · released 2026-10-19 · [advisory](https://access.redhat.com/errata/RHSA-2026:85244) - **RHSA-2026:76761** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 9) · released 2026-10-08 · [advisory](https://access.redhat.com/errata/RHSA-2026:76761) - **RHSA-2026:80694** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 9) · released 2026-10-12 · [advisory](https://access.redhat.com/errata/RHSA-2026:80694)