CVE-2026-100779 in Firefox
Summary
by MITRE • 09/29/2026
Use-after-free in the XSLT component. This vulnerability was fixed in Firefox ESR 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 09/29/2026
The identified vulnerability represents a critical memory management error classified as an out-of-bounds write or use-after-free condition within the Extensible Stylesheet Language Transformations (XSLT) engine of Mozilla Firefox browsers. This specific component is responsible for processing XML documents using XSL stylesheets to transform data into various output formats such as HTML, PDF, or plain text. The flaw arises when the application fails to properly manage memory allocation and deallocation cycles during complex stylesheet transformations. Specifically, a pointer to a previously freed memory block remains accessible after the underlying object has been destroyed, allowing an attacker who controls the input XML or XSLT data to manipulate this dangling reference. This scenario typically occurs in scenarios involving recursive template processing or dynamic node set manipulation where garbage collection timing and manual memory management intersect improperly within the C++ backend of the browser engine.
From a technical perspective, use-after-free vulnerabilities are particularly dangerous because they allow for arbitrary read and write operations on heap memory. When an attacker triggers this condition by supplying a maliciously crafted XML document with specific XSLT instructions, they can overwrite adjacent memory structures or execute code in the context of the compromised process. This capability effectively bypasses standard browser sandboxing mechanisms if the exploited object holds sensitive privileges or is located within a critical subsystem such as the rendering engine or network stack. The vulnerability impacts not only Firefox ESR 153.4 and version 157 but also extends to long-term support releases like Firefox ESR 115.42 and Firefox ESR 140.17, indicating that the root cause was present in older codebases that were retroactively patched or shared common architectural components with newer versions.
The operational impact of this vulnerability is severe, potentially leading to remote code execution on affected systems without user interaction beyond visiting a malicious website hosting the exploit payload. Attackers can leverage this flaw to install malware, steal sensitive information such as cookies and session tokens, or establish persistent access within an enterprise network if Firefox is used for internal applications. The presence of this issue in Extended Support Release (ESR) versions highlights its significance, as these releases are widely deployed in corporate environments where stability is prioritized over frequent feature updates, making them attractive targets for state-sponsored actors and cybercriminals seeking long-term footholds.
To mitigate the risks associated with this vulnerability, organizations must ensure that all instances of Firefox ESR 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17 are updated to their respective latest patch levels immediately. For environments where immediate browser updates are not feasible due to compatibility testing requirements, network-level controls such as web content filtering should be employed to block access to untrusted domains hosting XML-based exploits. Additionally, enabling strict Content Security Policies and disabling unnecessary XSLT processing capabilities in enterprise configurations can reduce the attack surface. Monitoring for anomalous memory usage patterns or unusual outbound connections from browser processes may also aid in detecting active exploitation attempts before significant damage occurs.
This vulnerability aligns with Common Weakness Enumeration (CWE) identifier CWE-416, which describes use-after-free conditions resulting from improper handling of freed pointers. In the context of the MITRE ATT&CK framework, this flaw facilitates techniques related to Initial Access via Spearphishing Attachment or Drive-by Compromise, specifically leveraging software vulnerabilities for execution. The exploitation path typically involves crafting a malicious XML file that triggers the memory corruption during parsing, leading to code execution under the user's privileges. Remediation efforts must prioritize patch management protocols and regular vulnerability scanning to ensure that such high-severity flaws do not persist in production environments.