CVE-2026-100773

Use-after-free in the Storage: IndexedDB component

Risk score: 62/100
CVSS: 8.8 v3.1
Exploit chance (30 days): 0.3%
Published: 29 Sep 2026

Open in the live forecast Today's forecast

What to know

What it is: Use-after-free in the Storage: IndexedDB component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.
Affected: Firefox
Fix: Apply the vendor's security update; see the linked advisory.
Exploitation: No known exploitation

Story map

Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

Firefox: Amber, patch this week. Invalid pointer in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, and Firefox ESR 140.17.

The flaws

CVE-2026-100773: Use-after-free in the Storage: IndexedDB component (CVSS 8.8 · EPSS 0%)
CVE-2026-100788: Invalid pointer in the JavaScript: WebAssembly component (CVSS 9.8 · EPSS 0%)
CVE-2026-100775: Sandbox escape in the Graphics component (CVSS 9.6 · EPSS 0%)
CVE-2026-100781: Sandbox escape due to incorrect boundary conditions in the Graphics: WebRender component (CVSS 9.6 · EPSS 0%)

The fix

Fix: Apply the vendor's security update; see the linked advisory.

Who is exposed: Firefox

Where it stands

No known exploitation

Connects to

Same weakness: Use-after-free (CWE-416). 399 other warnings in 30 days
Same product: Earlier Firefox warnings. 73 in the last 90 days

Why it is Amber

CVSS 8.8 high
Remotely exploitable without logging in

References

Original description

Use-after-free in the Storage: IndexedDB component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.

Last activity 29 Sep 2026. Patch Forecast updates every hour.