Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
8.8
CVE-2026-100767: Firefox and Thunderbird may execute unwanted code
CVE-2026-100767 · published 1 month ago
Summary
The web browser Firefox and email program Thunderbird have a coding mistake that could let a malicious website or email cause the program to run code it shouldn't. This can lead to data loss or unauthorized access. Update to the latest versions of Firefox, Firefox ESR, Thunderbird, and the related Debian and Ubuntu JavaScript components to fix the issue.
What to do
- Update debian firefox-esr to version 153.4.0esr-1~deb13u1.
- Update debian firefox-esr to version 153.4.0esr-1~deb12u1.
- Update debian firefox-esr to version 153.4.0esr-1.
- Update debian thunderbird to version 1:140.17.0esr-1~deb12u1.
- Update debian thunderbird to version 1:140.17.0esr-1~deb13u1.
- Update debian thunderbird to version 1:153.4.0esr-1.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| – | mozilla | firefox | All versions |
| – | mozilla | thunderbird | All versions |
| Debian:12 | debian | firefox-esr |
< 153.4.0esr-1~deb12u1 Fix: upgrade to 153.4.0esr-1~deb12u1
|
| Debian:13 | debian | firefox-esr |
< 153.4.0esr-1~deb13u1 Fix: upgrade to 153.4.0esr-1~deb13u1
|
| Ubuntu:18.04:LTS | canonical | mozjs52 | All versions |
| Ubuntu:18.04:LTS | canonical | mozjs38 | All versions |
| Ubuntu:20.04:LTS | canonical | mozjs68 | All versions |
| Ubuntu:22.04:LTS | canonical | mozjs102 | All versions |
| Ubuntu:22.04:LTS | canonical | mozjs78 | All versions |
| Ubuntu:22.04:LTS | canonical | mozjs91 | All versions |
| Ubuntu:22.04:LTS | canonical | thunderbird | All versions |
| Ubuntu:24.04:LTS | canonical | mozjs115 | All versions |
| Debian:12 | debian | thunderbird |
< 1:140.17.0esr-1~deb12u1 Fix: upgrade to 1:140.17.0esr-1~deb12u1
|
| Debian:14 | debian | firefox-esr |
< 153.4.0esr-1 Fix: upgrade to 153.4.0esr-1
|
| Debian:13 | debian | thunderbird |
< 1:140.17.0esr-1~deb13u1 Fix: upgrade to 1:140.17.0esr-1~deb13u1
|
| Debian:14 | debian | thunderbird |
< 1:153.4.0esr-1 Fix: upgrade to 1:153.4.0esr-1
|
Original advisory text
Use-after-free in the Networking: Cache component
Use-after-free in the Networking: Cache component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.
References
- https://bugzilla.mozilla.org/show_bug.cgi?id=2063680 Third Party Advisory
- https://www.mozilla.org/security/advisories/mfsa2026-100/ Third Party Advisory
- https://www.mozilla.org/security/advisories/mfsa2026-97/ Third Party Advisory
- https://www.mozilla.org/security/advisories/mfsa2026-98/ Third Party Advisory
- https://security-tracker.debian.org/tracker/CVE-2026-100767 Vendor Advisory
- https://www.mozilla.org/security/advisories/mfsa2026-101/
- https://www.mozilla.org/security/advisories/mfsa2026-102/
- https://www.mozilla.org/security/advisories/mfsa2026-103/
- https://ubuntu.com/security/CVE-2026-100767 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2026-100767 Third Party Advisory
- https://www.mozilla.org/en-US/security/advisories/mfsa2026-97/#CVE-2026-100767 Third Party Advisory
- https://www.mozilla.org/en-US/security/advisories/mfsa2026-100/#CVE-2026-100767 Third Party Advisory
- https://www.mozilla.org/security/advisories/mfsa2026-99/ Third Party Advisory
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker full control
Severity
8.8
High
Type
CWE-416Use After Free
Timeline
Published29 Sep 2026
Updated31 Oct 2026
First seen29 Sep 2026
Sources
CVE-2026-100767 · NVD
CVE-2026-100767 · MITRE
DEBIAN-CVE-2026-100767 · OSV
UBUNTU-CVE-2026-100767 · OSV
Track software like this
Free during beta