High-severity memory corruption in a widely used browser (Firefox) enabling potential remote code execution; affects mainstream and ESR releases and warrants broad IT notification.
CVE-2026-100790
Use-after-free in Firefox XSLT enabling possible remote code execution
Is CVE-2026-100790 being exploited?
Not confirmed. CVE-2026-100790 does not appear in CISA's Known Exploited Vulnerabilities catalog, which records only exploitation that has been observed and reported publicly. That is evidence of absence of a report, not evidence the flaw is unattacked.
How severe is CVE-2026-100790?
CVE-2026-100790 is rated High with a CVSS score of 8.8. Severity describes how bad exploitation would be, not how likely it is: pair it with exploitation evidence before deciding what to patch first.
Is there a patch for CVE-2026-100790?
Yes. A fix has been recorded for CVE-2026-100790. The vendor advisory is the authority on the exact fixed version — apply it from there rather than from a summary.
What does CVE-2026-100790 affect?
CVE-2026-100790 affects Mozilla Firefox (desktop) versions prior to 157, Firefox ESR versions prior to 153.4, Firefox ESR versions prior to 140.17, Firefox ESR versions prior to 115.42. Confirm the exact affected versions against the vendor advisory before deciding you are exposed.
What should I do about CVE-2026-100790?
Upgrade Firefox to the listed fixed versions immediately; apply ESR updates.
Exploitation status reflects CISA's KEV catalog as we last synced it. Check the catalog directly.
Potential remote code execution via crafted XSLT causing memory corruption in affected Firefox processes.
Immediate action required