CVE-2026-100766 in Firefox
Summary
by MITRE • 09/29/2026
Information disclosure in the Networking: JAR component. This vulnerability was fixed in Firefox ESR 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/29/2026
The identified vulnerability resides within the Networking: JAR component of Mozilla Firefox browsers, representing a critical information disclosure flaw that compromises user privacy by exposing sensitive internal data to potentially malicious actors or unintended external entities. This specific weakness allows for the unauthorized retrieval of resources stored in Java Archive (JAR) files through improper handling of network requests and resource loading mechanisms. The core technical issue stems from insufficient validation or sanitization processes when the browser engine interacts with JAR-based assets, particularly during cross-origin contexts or when processing malformed URLs that target internal archive structures. By exploiting this flaw, an attacker can craft a specially designed web page or malicious script that triggers the browser to leak details about the contents of these archives, such as file paths, directory structures, or potentially sensitive configuration data embedded within the JAR files themselves. This type of vulnerability is categorized under CWE-200: Information Exposure, which broadly covers scenarios where an application inadvertently reveals security-relevant information to unauthorized parties. The operational impact of this disclosure can be significant in environments where Firefox is used for enterprise applications or internal tools that rely on local resources packaged within JAR files. An attacker leveraging this vulnerability could gain insights into the underlying architecture of web applications, identify specific file names that might contain further vulnerabilities, or map out sensitive directories that were not intended to be accessible via standard HTTP requests. Such information gathering is often a precursor to more severe attacks, including directory traversal exploits or targeted phishing campaigns based on discovered organizational structures. The vulnerability was addressed in recent security updates for Firefox ESR 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17, indicating that the fix involved tightening access controls around JAR resource loading and ensuring that internal paths are not exposed through network responses or error messages. From a threat intelligence perspective, this flaw aligns with ATT&CK technique T1083: File and Directory Discovery, where adversaries use operating system utilities to explore file systems for valuable information. Although the primary vector is web-based, the exploitation relies on the browser's ability to interpret JAR URIs, which are often used in legacy Java applets or specific enterprise plugins integrated into modern browsers. To mitigate this risk, organizations must ensure that all Firefox instances across their infrastructure are updated to one of the patched versions mentioned above. Additionally, security administrators should review any custom configurations or extensions that might interact with JAR resources and disable unnecessary capabilities if they are not actively required by business processes. Regular patch management cycles are essential to close such gaps before they can be weaponized in the wild. Furthermore, implementing strict Content Security Policy (CSP) headers can help restrict how scripts access local resources, adding an additional layer of defense against information leakage attempts. Monitoring browser logs for unusual requests targeting JAR URIs or internal paths can also aid in detecting potential exploitation attempts during the window between vulnerability discovery and patch deployment.