CVE-2026-100790 in Firefox
Summary
by MITRE • 09/29/2026
Use-after-free in the XSLT component. This vulnerability was fixed in Firefox ESR 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 09/29/2026
The identified vulnerability represents a critical memory management error within the Extensible Stylesheet Language Transformations component of Mozilla-based browsers, specifically classified as an use-after-free condition. This type of flaw occurs when software continues to reference a block of memory after it has been deallocated or freed by the system. In the context of XSLT processing, which involves complex parsing and transformation of XML documents into other formats such as HTML, the engine must dynamically allocate and manage various data structures representing nodes in the document tree. When an attacker crafts a maliciously constructed stylesheet or input document that triggers specific edge cases during the transformation process, it can cause the application to release memory associated with these internal objects prematurely while references to those same objects remain active within other parts of the execution context.
From a technical perspective, this vulnerability stems from improper lifecycle management of heap-allocated objects. The XSLT processor likely maintains pointers or handles that are not correctly invalidated upon deallocation. Consequently, subsequent operations attempting to access these dangling pointers result in undefined behavior. Depending on how the memory allocator has reused the freed block for other purposes, an attacker may be able to read sensitive data from adjacent heap regions through a use-after-free read vulnerability, potentially leading to information disclosure of browser internals or user session cookies. More critically, if the attacker can control the content written into the reallocated memory before it is accessed again, this flaw can facilitate arbitrary code execution with the privileges of the current user process. This makes the issue particularly severe as it bypasses many standard security mitigations that rely on predictable memory states.
The operational impact of such a vulnerability extends beyond simple application crashes or denial of service. While early exploitation attempts might result in browser instability, sophisticated attackers can leverage this flaw to execute arbitrary code within the context of the web page being processed. This effectively compromises the integrity and confidentiality of the user's browsing session. An attacker could inject malicious scripts that exfiltrate sensitive information, hijack active sessions, or install persistent malware on the victim's system if combined with other vulnerabilities in the browser engine. The risk is amplified because XSLT transformations are often triggered automatically by web pages without explicit user interaction beyond visiting a compromised site, making this an attractive target for drive-by attack campaigns targeting users of Firefox and its derivatives.
Industry standards categorize this flaw under CWE-416, which defines use-after-free errors as a subset of improper memory handling vulnerabilities that lead to undefined behavior and potential security breaches. In the context of the MITRE ATT&CK framework, exploitation of this vulnerability aligns with techniques related to execution via browser-based attacks, specifically leveraging client-side code injection or script embedding through crafted web content. The attack vector typically involves delivering a malicious XML document containing an XSLT stylesheet that exploits the memory corruption during parsing and transformation phases. This falls under initial access vectors where social engineering or compromised websites serve as the delivery mechanism for exploiting software vulnerabilities in widely used applications.
Mitigation strategies primarily rely on applying the vendor-provided patches released in Firefox ESR 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17. These updates contain code changes that ensure proper reference counting or explicit nullification of pointers after memory deallocation, thereby preventing access to freed blocks. Organizations should prioritize updating all instances of affected browsers across their infrastructure immediately to close this security gap. Additionally, implementing strict content security policies and disabling unnecessary XSLT processing capabilities where not required can reduce the attack surface. Security teams should also monitor for indicators of compromise related to memory corruption anomalies in browser processes and ensure that endpoint detection systems are configured to flag unusual heap activity patterns associated with exploitation attempts.