Patch Forecast
Yellow warning
Plan into this sprint.

CVE-2026-100816

Site isolation issue in the DOM: Networking component

Risk score
54/100
CVSS
8.1 v3.1
Exploit chance (30 days)
0.2%
Published
29 Sep 2026

Open in the live forecast Today's forecast

What to know

What it is
Site isolation issue in the DOM: Networking component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157.
Affected
Firefox
Fix
Apply the vendor's security update; see the linked advisory.
Exploitation
No known exploitation

Story map

Story map: FirefoxTHE FLAWSTHE FIXCVE-2026-100816Site isolation issue in the DOM:Networking componentCVSS 8.1 · EPSS 0%CVE-2026-100788Invalid pointer in theJavaScript: WebAssemblycomponentCVSS 9.8 · EPSS 0%CVE-2026-100775Sandbox escape in the GraphicscomponentCVSS 9.6 · EPSS 0%CVE-2026-100781Sandbox escape due toincorrect boundary conditionsin the Graphics: WebRender…CVSS 9.6 · EPSS 0%FixApply the vendor's securityupdate; see the linked advisory.Who is exposedFirefoxAMBER · PATCH THIS WEEKFirefoxInvalid pointer in theJavaScript: WebAssemblycomponent. This vulnerabilitywas fixed in Firefox ESR 153.4,Thunderbird 157, Thunderbird140.17, Thunderbird 153.4,Firefox 157, and Firefox ESR…Where it standsNo known exploitationCONNECTS TOSame weaknessCWE-346 (CWE-346)54 other warnings in 30 days →Same productEarlier Firefox warnings73 in the last 90 days →
Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

Firefox: Amber, patch this week. Invalid pointer in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, and Firefox ESR 140.17.

The flaws

  • CVE-2026-100816: Site isolation issue in the DOM: Networking component (CVSS 8.1 · EPSS 0%)
  • CVE-2026-100788: Invalid pointer in the JavaScript: WebAssembly component (CVSS 9.8 · EPSS 0%)
  • CVE-2026-100775: Sandbox escape in the Graphics component (CVSS 9.6 · EPSS 0%)
  • CVE-2026-100781: Sandbox escape due to incorrect boundary conditions in the Graphics: WebRender component (CVSS 9.6 · EPSS 0%)

The fix

Fix: Apply the vendor's security update; see the linked advisory.

Who is exposed: Firefox

Where it stands

  • No known exploitation

Connects to

Why it is Yellow

  • CVSS 8.1 high
  • Remotely exploitable without logging in

References

Original description

Site isolation issue in the DOM: Networking component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157.

Last activity 29 Sep 2026. Patch Forecast updates every hour.