CVE-2026-106016

Mitigation bypass in the File Handling component

Risk score: 69/100
CVSS: 9.8 v3.1
Exploit chance (30 days): 0.3%
Published: 6 Oct 2026

Open in the live forecast Today's forecast

What to know

What it is: Mitigation bypass in the File Handling component. This vulnerability was fixed in Firefox 157.0.1 and Thunderbird 158.
Affected: Firefox
Fix: Apply the vendor's security update; see the linked advisory.
Exploitation: No known exploitation

Story map

Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

Firefox: Amber, patch this week. Invalid pointer in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, and Firefox ESR 140.17.

The flaws

CVE-2026-106016: Mitigation bypass in the File Handling component (CVSS 9.8 · EPSS 0%)
CVE-2026-100788: Invalid pointer in the JavaScript: WebAssembly component (CVSS 9.8 · EPSS 0%)
CVE-2026-100775: Sandbox escape in the Graphics component (CVSS 9.6 · EPSS 0%)
CVE-2026-100781: Sandbox escape due to incorrect boundary conditions in the Graphics: WebRender component (CVSS 9.6 · EPSS 0%)

The fix

Fix: Apply the vendor's security update; see the linked advisory.

Who is exposed: Firefox

Where it stands

No known exploitation

Connects to

Same weakness: CWE-693 (CWE-693). 59 other warnings in 30 days
Same product: Earlier Firefox warnings. 73 in the last 90 days

Why it is Amber

CVSS 9.8 critical
Remotely exploitable without logging in

References

Original description

Mitigation bypass in the File Handling component. This vulnerability was fixed in Firefox 157.0.1 and Thunderbird 158.

Last activity 6 Oct 2026. Patch Forecast updates every hour.