Patch Forecast
Amber warning
Patch this week.

CVE-2026-100775

Sandbox escape in the Graphics component

Risk score
68/100
CVSS
9.6 v3.1
Exploit chance (30 days)
0.3%
Published
29 Sep 2026

Open in the live forecast Today's forecast

What to know

What it is
Sandbox escape in the Graphics component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.
Affected
Firefox
Fix
Apply the vendor's security update; see the linked advisory.
Exploitation
No known exploitation

Story map

Story map: FirefoxTHE FLAWSTHE FIXCVE-2026-100775Sandbox escape in the GraphicscomponentCVSS 9.6 · EPSS 0%CVE-2026-100788Invalid pointer in theJavaScript: WebAssemblycomponentCVSS 9.8 · EPSS 0%CVE-2026-100781Sandbox escape due toincorrect boundary conditionsin the Graphics: WebRender…CVSS 9.6 · EPSS 0%CVE-2026-100794Sandbox escape due toincorrect boundary conditionsin the Internationalization…CVSS 9.6 · EPSS 0%FixApply the vendor's securityupdate; see the linked advisory.Who is exposedFirefoxAMBER · PATCH THIS WEEKFirefoxInvalid pointer in theJavaScript: WebAssemblycomponent. This vulnerabilitywas fixed in Firefox ESR 153.4,Thunderbird 157, Thunderbird140.17, Thunderbird 153.4,Firefox 157, and Firefox ESR…Where it standsNo known exploitationCONNECTS TOSame weaknessCWE-693 (CWE-693)60 other warnings in 30 days →Same productEarlier Firefox warnings73 in the last 90 days →
Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

Firefox: Amber, patch this week. Invalid pointer in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, and Firefox ESR 140.17.

The flaws

  • CVE-2026-100775: Sandbox escape in the Graphics component (CVSS 9.6 · EPSS 0%)
  • CVE-2026-100788: Invalid pointer in the JavaScript: WebAssembly component (CVSS 9.8 · EPSS 0%)
  • CVE-2026-100781: Sandbox escape due to incorrect boundary conditions in the Graphics: WebRender component (CVSS 9.6 · EPSS 0%)
  • CVE-2026-100794: Sandbox escape due to incorrect boundary conditions in the Internationalization component (CVSS 9.6 · EPSS 0%)

The fix

Fix: Apply the vendor's security update; see the linked advisory.

Who is exposed: Firefox

Where it stands

  • No known exploitation

Connects to

Why it is Amber

  • CVSS 9.6 critical
  • Remotely exploitable without logging in

References

Original description

Sandbox escape in the Graphics component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.

Last activity 29 Sep 2026. Patch Forecast updates every hour.