CVE-2026-100809

Same-origin policy bypass in the DevTools component

Risk score: 54/100
CVSS: 8.1 v3.1
Exploit chance (30 days): 0.2%
Published: 29 Sep 2026

Open in the live forecast Today's forecast

What to know

What it is: Same-origin policy bypass in the DevTools component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157.
Affected: Firefox
Fix: Apply the vendor's security update; see the linked advisory.
Exploitation: No known exploitation

Story map

Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

Firefox: Amber, patch this week. Invalid pointer in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, and Firefox ESR 140.17.

The flaws

CVE-2026-100809: Same-origin policy bypass in the DevTools component (CVSS 8.1 · EPSS 0%)
CVE-2026-100788: Invalid pointer in the JavaScript: WebAssembly component (CVSS 9.8 · EPSS 0%)
CVE-2026-100775: Sandbox escape in the Graphics component (CVSS 9.6 · EPSS 0%)
CVE-2026-100781: Sandbox escape due to incorrect boundary conditions in the Graphics: WebRender component (CVSS 9.6 · EPSS 0%)

The fix

Fix: Apply the vendor's security update; see the linked advisory.

Who is exposed: Firefox

Where it stands

No known exploitation

Connects to

Same weakness: CWE-346 (CWE-346). 54 other warnings in 30 days
Same product: Earlier Firefox warnings. 73 in the last 90 days

Why it is Yellow

CVSS 8.1 high
Remotely exploitable without logging in

References

Original description

Same-origin policy bypass in the DevTools component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157.

Last activity 29 Sep 2026. Patch Forecast updates every hour.