CVE-2026-100815
HighCVSS 8.8Summary
Use-after-free vulnerability in the CSS Parsing and Computation component. Fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157.
Risk Assessment
Use-after-free could lead to application crashes or potentially arbitrary code execution, posing a serious security risk.
Recommendation
Update Firefox or Thunderbird to the patched versions immediately.
Other vulnerabilities in Firefox
See all- CVE-2026-100832High
Use-after-free in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 140.17, Thunderbird 153.4, Firefox ESR 115.42, and Firefox ESR 140.17.
- CVE-2026-100831High
Use-after-free in the DOM: UI Events & Focus Handling component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157.
- CVE-2026-100825High
Use-after-free in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157.
- CVE-2026-100824High
Privilege escalation vulnerability in the Places component. Fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157.
- CVE-2026-100820High
Privilege escalation vulnerability in the Address Bar component. Fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, and Firefox ESR 140.17.
- CVE-2026-100814High
Incorrect boundary conditions in the JavaScript Engine: JIT component. Fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157.
- CVE-2026-100813High
Invalid pointer in the JavaScript Engine: JIT component. Fixed in Thunderbird 157 and Firefox 157.
- CVE-2026-100807High
Privilege escalation vulnerability in the DOM: Service Workers component. Fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, and Firefox ESR 140.17.
- CVE-2026-100805High
Race condition and use-after-free vulnerability in the Audio/Video component. Fixed in Thunderbird 157 and Firefox 157.
- CVE-2026-100801High
Privilege escalation vulnerability in the DLL Services component. Fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, and Firefox ESR 140.17.
Original NVD description (English source)
Use-after-free in the CSS Parsing and Computation component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS