CVE-2026-100766: Mozilla Firefox Information Disclosure

CVE-2026-100766 Overview

CVE-2026-100766 is an information disclosure vulnerability in the Networking: JAR component used by Mozilla Firefox and Thunderbird. The flaw allows a remote attacker to expose limited data from the victim's browser when the user is tricked into interacting with attacker-controlled content. Mozilla has published fixes across Firefox, Firefox ESR, and Thunderbird release trains. The issue is classified under CWE-200: Exposure of Sensitive Information to an Unauthorized Actor.

Critical Impact
Successful exploitation leaks limited confidential information over the network without requiring authentication, but requires user interaction such as visiting a crafted page or opening a malicious message.

Affected Products

Mozilla Firefox versions prior to 157
Mozilla Firefox ESR versions prior to 115.42, 140.17, and 153.4
Mozilla Thunderbird versions prior to 140.17, 153.4, and 157

Discovery Timeline

2026-09-29 - CVE-2026-100766 published to the National Vulnerability Database
2026-09-30 - Last updated in NVD database

Technical Details for CVE-2026-100766

Vulnerability Analysis

The vulnerability resides in the Networking: JAR component, which handles requests for resources packaged inside Java Archive (JAR) files loaded over the network. Improper handling within this subsystem allows an attacker to observe or infer confidential information that should remain isolated from web content. The attacker delivers the exploit over the network, and the target must perform an action such as loading a crafted page or opening a message that references the malicious resource. Mozilla addressed the defect in Firefox 157, Firefox ESR 115.42, Firefox ESR 140.17, Firefox ESR 153.4, Thunderbird 140.17, Thunderbird 153.4, and Thunderbird 157.

Root Cause

The root cause is improper information exposure inside the JAR protocol handler, aligning with CWE-200. The component fails to correctly restrict access to internal state or response data that is derived from cross-origin content. Full technical details are tracked in the vendor bug entry.

Attack Vector

Exploitation requires a user to visit a page or open a message that loads a jar: URI crafted by the attacker. Because the attack is network-based and unauthenticated, adversaries can incorporate it into phishing campaigns, malvertising, or watering-hole pages. The impact is limited to confidentiality; integrity and availability are not affected.

No public proof-of-concept code has been published. Refer to the Mozilla Bug Report #2061526 and Mozilla Foundation Security Advisory MFSA-2026-97 for authoritative technical details.

Detection Methods for CVE-2026-100766

Indicators of Compromise

Web sessions or email messages that load resources through the jar: URI scheme from untrusted origins.
Outbound HTTP(S) requests to attacker-controlled hosts serving .jar archives referenced by crafted pages.
Client browser or Thunderbird process versions that predate the fixed releases published in Mozilla advisories MFSA-2026-97 through MFSA-2026-103.

Detection Strategies

Inventory endpoint software to identify Firefox, Firefox ESR, and Thunderbird instances running versions below the patched builds.
Inspect web proxy and DNS logs for unusual jar: scheme handling or downloads of .jar archives from low-reputation domains.
Correlate email gateway telemetry with client-side telemetry to flag messages that embed remote content dereferencing JAR resources.

Monitoring Recommendations

Enable browser and email client version reporting through endpoint management tooling to track patch adoption.
Alert on new or rare parent-child process relationships involving Firefox or Thunderbird spawning helpers to handle archive content.
Ingest proxy, DNS, and endpoint telemetry into a centralized analytics platform to hunt for the jar: scheme across historical logs.

How to Mitigate CVE-2026-100766

Immediate Actions Required

Upgrade Firefox to version 157, Firefox ESR to 115.42, 140.17, or 153.4, and Thunderbird to 140.17, 153.4, or 157 as appropriate for each channel.
Push the updates through enterprise software distribution channels and verify installation on managed endpoints.
Remind users to avoid opening unsolicited links or messages that could load attacker-controlled content until patches are deployed.

Patch Information

Mozilla released fixes in the advisories referenced by this CVE, including MFSA-2026-97, MFSA-2026-98, MFSA-2026-99, MFSA-2026-100, MFSA-2026-101, MFSA-2026-102, and MFSA-2026-103. Administrators should follow the advisory that matches the deployed product and release channel.

Workarounds

Restrict browser and email client handling of the jar: URI scheme through enterprise policy where the platform allows it.
Block downloads of .jar archives at the web proxy and email gateway for users who do not require them for business functions.
Enforce strict email content filtering to strip remote content from untrusted senders in Thunderbird deployments.

bash

# Configuration example
# Mozilla policy template snippet: block downloads of .jar archives via managed policy
# Refer to https://mozilla.github.io/policy-templates/ for full schema
{
  "policies": {
    "ExemptDomainFileTypePairsFromFileTypeDownloadWarnings": [],
    "BlockAboutConfig": true,
    "DisableSafeMode": true
  }
}