CVE-2026-100768
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk21th percentile - higher than 21% of all known CVEs
Summary
Use-after-free vulnerability in the Graphics: WebGPU component of Firefox and Thunderbird. It was fixed in Firefox 157 and Thunderbird 157.
Risk Assessment
It may lead to arbitrary code execution or application crash, posing a threat to workstation security.
Recommendation
Update Firefox and Thunderbird to version 157.
Other vulnerabilities in Firefox
See all- CVE-2026-109778High
A privilege escalation vulnerability in the WebExtensions component. It was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.
- CVE-2026-109756High
A privilege escalation vulnerability in the DOM: Navigation component. It was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.
- CVE-2026-109709High
An information disclosure and privilege escalation vulnerability in the Security: Process Sandboxing component. It was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.
- CVE-2026-109707Critical
Sandbox escape due to use-after-free in the Networking component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.
- CVE-2026-109705Critical
Sandbox escape, site isolation issue due to incorrect boundary conditions, use-after-free in the Networking component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.
- CVE-2026-106016Critical
Mitigation bypass in the File Handling component. This vulnerability was fixed in Firefox 157.0.1 and Thunderbird 158.
- CVE-2026-100829Critical
Mitigation bypass in the DOM: Security component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157.
- CVE-2026-100828Critical
Mitigation bypass in the Bookmarks & History component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157.
- CVE-2026-100819Critical
Sandbox escape due to incorrect boundary conditions in the XPCOM component. Fixed in multiple Firefox and Thunderbird versions.
- CVE-2026-100818Critical
Sandbox escape due to use-after-free in the Widget: Gtk component. Fixed in multiple Firefox and Thunderbird versions.
Original NVD description (English source)
Use-after-free in the Graphics: WebGPU component. This vulnerability was fixed in Thunderbird 157 and Firefox 157.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS