{"id":"CVE-2026-100811","published":"2026-09-29T13:17:46.230","lastModified":"2026-09-30T04:18:16.847","description":"Sandbox escape due to use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox ESR 153.4, Firefox 157, and Firefox ESR 140.17.","cvssScore":9.6,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","cwes":["CWE-416"],"vendors":[],"products":[],"references":[{"url":"https://bugzilla.mozilla.org/show_bug.cgi?id=2067973","tags":[]},{"url":"https://www.mozilla.org/security/advisories/mfsa2026-100/","tags":[]},{"url":"https://www.mozilla.org/security/advisories/mfsa2026-97/","tags":[]},{"url":"https://www.mozilla.org/security/advisories/mfsa2026-99/","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"This flaw allows attackers to escape the sandbox by exploiting a use-after-free vulnerability in the DOM: Core & HTML component, leading to potential code execution.","exploitability":"Exploitation requires specific conditions and is moderately difficult, as it involves precise timing and control over memory management.","blast_radius":"If exploited, this vulnerability could lead to full code execution on the affected system, potentially allowing attackers to install programs, view, change, and delete data, or create new accounts with full user rights.","remediation":"Upgrade to Firefox ESR 153.4, Firefox 157, or Firefox ESR 140.17 or later.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["code-execution","web","browser"],"model":"qwen2.5:7b-instruct","analyzedAt":"2026-09-30T08:50:54.775Z"}}