Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.8
CVE-2026-100788: Firefox and Thunderbird allow malicious WebAssembly memory access
CVE-2026-100788 · published 20 days ago
Summary
A coding error in the JavaScript engine that runs WebAssembly code could let specially crafted web pages read or write memory they shouldn't. This could let attackers execute unwanted actions on your computer. Upgrade Firefox, Thunderbird, and any bundled Mozilla JavaScript runtimes (such as the Debian ESR or Canonical packages) to the latest releases to resolve the issue.
What to do
- Update debian firefox-esr to version 153.4.0esr-1~deb13u1.
- Update debian firefox-esr to version 153.4.0esr-1~deb12u1.
- Update debian firefox-esr to version 153.4.0esr-1.
- Update debian thunderbird to version 1:140.17.0esr-1~deb12u1.
- Update debian thunderbird to version 1:140.17.0esr-1~deb13u1.
- Update debian thunderbird to version 1:153.4.0esr-1.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| – | mozilla | firefox | All versions |
| – | mozilla | thunderbird | All versions |
| Debian:12 | debian | firefox-esr |
< 153.4.0esr-1~deb12u1 Fix: upgrade to 153.4.0esr-1~deb12u1
|
| Ubuntu:18.04:LTS | canonical | mozjs52 | All versions |
| Ubuntu:18.04:LTS | canonical | mozjs38 | All versions |
| Ubuntu:20.04:LTS | canonical | mozjs68 | All versions |
| Ubuntu:22.04:LTS | canonical | mozjs102 | All versions |
| Ubuntu:22.04:LTS | canonical | mozjs78 | All versions |
| Ubuntu:22.04:LTS | canonical | mozjs91 | All versions |
| Ubuntu:22.04:LTS | canonical | thunderbird | All versions |
| Ubuntu:24.04:LTS | canonical | mozjs115 | All versions |
| Debian:13 | debian | firefox-esr |
< 153.4.0esr-1~deb13u1 Fix: upgrade to 153.4.0esr-1~deb13u1
|
| Debian:12 | debian | thunderbird |
< 1:140.17.0esr-1~deb12u1 Fix: upgrade to 1:140.17.0esr-1~deb12u1
|
| Debian:14 | debian | firefox-esr |
< 153.4.0esr-1 Fix: upgrade to 153.4.0esr-1
|
| Debian:13 | debian | thunderbird |
< 1:140.17.0esr-1~deb13u1 Fix: upgrade to 1:140.17.0esr-1~deb13u1
|
| Debian:14 | debian | thunderbird |
< 1:153.4.0esr-1 Fix: upgrade to 1:153.4.0esr-1
|
Original advisory text
Invalid pointer in the JavaScript: WebAssembly component
Invalid pointer in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, and Firefox ESR 140.17.
References
- https://bugzilla.mozilla.org/show_bug.cgi?id=2072413 Third Party Advisory
- https://www.mozilla.org/security/advisories/mfsa2026-100/ Third Party Advisory
- https://www.mozilla.org/security/advisories/mfsa2026-97/ Third Party Advisory
- https://www.mozilla.org/security/advisories/mfsa2026-99/ Third Party Advisory
- https://security-tracker.debian.org/tracker/CVE-2026-100788 Vendor Advisory
- https://www.mozilla.org/security/advisories/mfsa2026-101/
- https://www.mozilla.org/security/advisories/mfsa2026-102/
- https://www.mozilla.org/security/advisories/mfsa2026-103/
- https://ubuntu.com/security/CVE-2026-100788 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2026-100788 Third Party Advisory
- https://www.mozilla.org/en-US/security/advisories/mfsa2026-97/#CVE-2026-100788 Third Party Advisory
- https://www.mozilla.org/en-US/security/advisories/mfsa2026-100/#CVE-2026-100788 Third Party Advisory
Internet-facing
3 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically
- Gives an attacker full control
Severity
9.8
Critical
Type
CWE-824Access of Uninitialized Pointer
Timeline
Published29 Sep 2026
Updated19 Oct 2026
First seen29 Sep 2026
Sources
CVE-2026-100788 · NVD
CVE-2026-100788 · MITRE
DEBIAN-CVE-2026-100788 · OSV
UBUNTU-CVE-2026-100788 · OSV
Track software like this
Free during beta