CVE-2026-100758: Firefox & Thunderbird Privilege Escalation

CVE-2026-100758 Overview

CVE-2026-100758 is a sandbox escape vulnerability in the DOM Navigation component affecting Mozilla Firefox, Firefox ESR, and Thunderbird. The flaw allows an attacker-controlled web page to break out of the browser's content sandbox when a user interacts with malicious content. Mozilla addressed the issue in Firefox 157, Firefox ESR 153.4, Firefox ESR 140.17, Firefox ESR 115.42, Thunderbird 157, Thunderbird 153.4, and Thunderbird 140.17. The weakness is classified under [CWE-284: Improper Access Control].

Critical Impact
Successful exploitation lets a remote attacker escape the browser sandbox, execute code in a higher-privilege context, and compromise the host beyond the rendering process.

Affected Products

Mozilla Firefox versions prior to 157
Mozilla Firefox ESR versions prior to 115.42, 140.17, and 153.4
Mozilla Thunderbird versions prior to 140.17, 153.4, and 157

Discovery Timeline

2026-09-29 - CVE-2026-100758 published to NVD
2026-09-30 - Last updated in NVD database

Technical Details for CVE-2026-100758

Vulnerability Analysis

The vulnerability resides in the DOM Navigation component, which coordinates how documents transition between origins, frames, and history entries. Improper access control in this navigation logic allows a crafted page to cross the boundary that isolates content-process code from privileged browser code. An attacker who lures a user into visiting a hostile page can escape the content sandbox and act with the privileges of the parent browser process. Because Thunderbird reuses the Gecko rendering engine, HTML email content can trigger the same code path when remote content is loaded.

Root Cause

The root cause is improper access control ([CWE-284]) within navigation handling. The component fails to correctly enforce origin and process boundaries during specific navigation transitions, permitting cross-boundary operations that should have been rejected. Mozilla's security advisories MFSA-2026-97 through MFSA-2026-103 document the corrective changes across Firefox and Thunderbird release trains.

Attack Vector

Exploitation requires a network-reachable attacker to deliver a crafted web page or HTML message and requires user interaction, such as visiting a link or opening an email with remote content enabled. No prior authentication is needed. The scope changes upon successful exploitation because the attacker gains privileges outside the initially compromised sandboxed component. Public exploit code is not currently listed for CVE-2026-100758, and the flaw is not on the CISA Known Exploited Vulnerabilities catalog.

Technical specifics are described in the Mozilla Bug Report #2049792 and the Mozilla Security Advisory MFSA-2026-97.

Detection Methods for CVE-2026-100758

Indicators of Compromise

Firefox or Thunderbird child processes spawning unexpected shells, scripting hosts, or LOLBins such as powershell.exe, cmd.exe, wscript.exe, or /bin/sh.
Content processes writing to autostart locations, user profile scripts, or scheduled task directories outside the browser cache.
Unexpected outbound connections from firefox.exe or thunderbird.exe to previously unseen infrastructure shortly after page load.

Detection Strategies

Hunt for parent-child process anomalies where the browser or mail client spawns interpreters or system utilities.
Correlate browser telemetry with file writes to persistence paths, focusing on %APPDATA%, ~/.config, and Launch Agents.
Alert on Thunderbird sessions that render remote content immediately followed by process creation events.

Monitoring Recommendations

Ingest endpoint process and network telemetry into a centralized analytics pipeline and retain browser process lineage.
Monitor installed Firefox, Firefox ESR, and Thunderbird versions across the fleet and flag hosts below the fixed builds.
Track outbound HTTP and DNS activity from browser processes for connections to newly registered or low-reputation domains.

How to Mitigate CVE-2026-100758

Immediate Actions Required

Update Firefox to 157 and Firefox ESR to 115.42, 140.17, or 153.4, matching your deployed ESR channel.
Update Thunderbird to 140.17, 153.4, or 157 across all managed workstations and servers.
Restart browser and mail client processes after patching to ensure the vulnerable code is unloaded from memory.

Patch Information

Mozilla released fixes across seven advisories: MFSA-2026-97, MFSA-2026-98, MFSA-2026-99, MFSA-2026-100, MFSA-2026-101, MFSA-2026-102, and MFSA-2026-103. Enterprise administrators should deploy the corresponding ESR build for their support channel.

Workarounds

Disable JavaScript for untrusted sites through enterprise policy until patches are applied.
Configure Thunderbird to block remote content in messages by default to reduce the exposure of email-rendered HTML.
Restrict browser use to allowlisted sites on high-value hosts through web filtering or proxy policy.

bash

# Configuration example: enforce updated Firefox baseline via policy
# /etc/firefox/policies/policies.json
{
  "policies": {
    "DisableAppUpdate": false,
    "AppAutoUpdate": true,
    "BlockAboutConfig": true,
    "OverrideFirstRunPage": "",
    "Preferences": {
      "javascript.enabled": {
        "Value": false,
        "Status": "user"
      }
    }
  }
}