CVE-2026-100821

Unknown

Published: 29/09/2026(UTC)Translated: 29/09/2026(UTC)NVD NIST

Summary

Site isolation issue in the Panning and Zooming component. This vulnerability was fixed in Firefox ESR 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.

Risk Assessment

A site isolation violation may allow a malicious page to access data from other sites open in the browser, posing a serious confidentiality risk. It affects Firefox users running versions older than the fixed releases.

Recommendation

Update Firefox to one of the fixed versions: 157, ESR 153.4, ESR 115.42, or ESR 140.17. Prioritize deployment of the update.

Other vulnerabilities in Firefox

See all

CVE-2026-96869Medium
Information disclosure in the Networking component. This vulnerability was fixed in Firefox ESR 153.4, Firefox 157, and Firefox ESR 140.17.
CVE-2026-100832High
Use-after-free in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox ESR 153.4, Firefox ESR 115.42, and Firefox ESR 140.17.
CVE-2026-100831High
Use-after-free in the DOM: UI Events & Focus Handling component. This vulnerability was fixed in Firefox ESR 153.4 and Firefox 157.
CVE-2026-100830Unknown
Mitigation bypass in the DOM: Navigation component. This vulnerability was fixed in Firefox ESR 153.4 and Firefox 157.
CVE-2026-100829Unknown
Mitigation bypass in the DOM: Security component. This vulnerability was fixed in Firefox ESR 153.4 and Firefox 157.
CVE-2026-100828Unknown
Mitigation bypass in the Bookmarks & History component. This vulnerability was fixed in Firefox ESR 153.4 and Firefox 157.
CVE-2026-100826Medium
Denial-of-service in the Storage: StorageManager component. This vulnerability was fixed in Firefox ESR 153.4 and Firefox 157.
CVE-2026-100825High
Use-after-free in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox ESR 153.4 and Firefox 157.
CVE-2026-100824High
Privilege escalation in the Places component. This vulnerability was fixed in Firefox ESR 153.4 and Firefox 157.
CVE-2026-100822Unknown
Spoofing issue in the Networking: HTTP component. This vulnerability was fixed in Firefox ESR 153.4 and Firefox 157.

Original NVD description (English source)

Site isolation issue in the Panning and Zooming component. This vulnerability was fixed in Firefox ESR 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS