Vulnerability Details CVE-2026-100772
Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, and Firefox ESR 140.17.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.003
EPSS Ranking 22.1%
CVSS Severity
CVSS v3 Score 8.8
References
- https://bugzilla.mozilla.org/show_bug.cgi?id=2068340
- https://www.mozilla.org/security/advisories/mfsa2026-100/
- https://www.mozilla.org/security/advisories/mfsa2026-101/
- https://www.mozilla.org/security/advisories/mfsa2026-102/
- https://www.mozilla.org/security/advisories/mfsa2026-103/
- https://www.mozilla.org/security/advisories/mfsa2026-97/
- https://www.mozilla.org/security/advisories/mfsa2026-99/
Products affected by CVE-2026-100772
-
cpe:2.3:a:mozilla:firefox:140.0.0
-
cpe:2.3:a:mozilla:firefox:140.0.1
-
cpe:2.3:a:mozilla:firefox:140.0.2
-
cpe:2.3:a:mozilla:firefox:140.0.4
-
cpe:2.3:a:mozilla:firefox:140.1.0
-
cpe:2.3:a:mozilla:firefox:140.10.0
-
cpe:2.3:a:mozilla:firefox:140.10.1
-
cpe:2.3:a:mozilla:firefox:140.10.2
-
cpe:2.3:a:mozilla:firefox:140.11.0
-
cpe:2.3:a:mozilla:firefox:140.12.0
-
cpe:2.3:a:mozilla:firefox:140.13.0
-
cpe:2.3:a:mozilla:firefox:140.14.0
-
cpe:2.3:a:mozilla:firefox:140.15.0
-
cpe:2.3:a:mozilla:firefox:140.2.0
-
cpe:2.3:a:mozilla:firefox:140.3
-
cpe:2.3:a:mozilla:firefox:140.3.0
-
cpe:2.3:a:mozilla:firefox:140.3.1
-
cpe:2.3:a:mozilla:firefox:140.4.0
-
cpe:2.3:a:mozilla:firefox:140.5.0
-
cpe:2.3:a:mozilla:firefox:140.6.0
-
cpe:2.3:a:mozilla:firefox:140.7.0
-
cpe:2.3:a:mozilla:firefox:140.7.1
-
cpe:2.3:a:mozilla:firefox:140.8.0
-
cpe:2.3:a:mozilla:firefox:140.9.0
-
cpe:2.3:a:mozilla:firefox:140.9.1
-
cpe:2.3:a:mozilla:firefox:153.0.0
-
cpe:2.3:a:mozilla:firefox:153.0.1
-
cpe:2.3:a:mozilla:firefox:153.0.3
-
cpe:2.3:a:mozilla:firefox:153.0.4
-
cpe:2.3:a:mozilla:firefox:153.1.0
-
cpe:2.3:a:mozilla:firefox:153.2.0
-
cpe:2.3:a:mozilla:firefox:154.0.0
-
cpe:2.3:a:mozilla:firefox:154.0.1
-
cpe:2.3:a:mozilla:firefox:155.0.0
-
cpe:2.3:a:mozilla:thunderbird:140.0
-
cpe:2.3:a:mozilla:thunderbird:140.0.1
-
cpe:2.3:a:mozilla:thunderbird:140.1.0
-
cpe:2.3:a:mozilla:thunderbird:140.1.1
-
cpe:2.3:a:mozilla:thunderbird:140.10.0
-
cpe:2.3:a:mozilla:thunderbird:140.10.1
-
cpe:2.3:a:mozilla:thunderbird:140.10.2
-
cpe:2.3:a:mozilla:thunderbird:140.11.0
-
cpe:2.3:a:mozilla:thunderbird:140.12.0
-
cpe:2.3:a:mozilla:thunderbird:140.12.1
-
cpe:2.3:a:mozilla:thunderbird:140.14.0
-
cpe:2.3:a:mozilla:thunderbird:140.15.0
-
cpe:2.3:a:mozilla:thunderbird:140.16.0
-
cpe:2.3:a:mozilla:thunderbird:140.2.0
-
cpe:2.3:a:mozilla:thunderbird:140.2.1
-
cpe:2.3:a:mozilla:thunderbird:140.3.0
-
cpe:2.3:a:mozilla:thunderbird:140.3.1
-
cpe:2.3:a:mozilla:thunderbird:140.4.0
-
cpe:2.3:a:mozilla:thunderbird:140.5.0
-
cpe:2.3:a:mozilla:thunderbird:140.6.0
-
cpe:2.3:a:mozilla:thunderbird:140.7.0
-
cpe:2.3:a:mozilla:thunderbird:140.7.1
-
cpe:2.3:a:mozilla:thunderbird:140.7.2
-
cpe:2.3:a:mozilla:thunderbird:140.8.0
-
cpe:2.3:a:mozilla:thunderbird:140.8.1
-
cpe:2.3:a:mozilla:thunderbird:140.9.0
-
cpe:2.3:a:mozilla:thunderbird:140.9.1
-
cpe:2.3:a:mozilla:thunderbird:153.0
-
cpe:2.3:a:mozilla:thunderbird:153.0.1
-
cpe:2.3:a:mozilla:thunderbird:153.0.2
-
cpe:2.3:a:mozilla:thunderbird:153.0.3
-
cpe:2.3:a:mozilla:thunderbird:153.1.0
-
cpe:2.3:a:mozilla:thunderbird:153.1.1
-
cpe:2.3:a:mozilla:thunderbird:153.2.0
-
cpe:2.3:a:mozilla:thunderbird:153.3.0
-
cpe:2.3:a:mozilla:thunderbird:153.3.1
-
cpe:2.3:a:mozilla:thunderbird:154.0
-
cpe:2.3:a:mozilla:thunderbird:155.0
-
cpe:2.3:a:mozilla:thunderbird:155.0.1
-
cpe:2.3:a:mozilla:thunderbird:156.0
-
cpe:2.3:a:mozilla:thunderbird:156.0.1