# CVE-2026-100797

Use-after-free in Firefox WebRender allows privilege escalation; fixed in recent Firefox/ESR.

- Page: https://www.vulneraibility.com/cve/CVE-2026-100797
- CVSS: 8.8
- Known exploited: not in CISA KEV as of our last sync
- EPSS: 0.25% (percentile 16.7)
- CISA SSVC: exploitation none, automatable no, technical impact total (assessed 2026-09-29)
- Weakness: CWE-416
- Published: 2026-09-29

## Affected

- Mozilla Firefox (Desktop) - versions prior to fixes
- Firefox 157 (fixed)
- Firefox ESR 153.4 (fixed)
- Firefox ESR 115.42 (fixed)
- Firefox ESR 140.17 (fixed)

## Impact

Local privilege escalation via use-after-free in WebRender; can escape browser sandbox and elevate attacker to higher OS privileges.

## Action

Patch when possible

## Recommendation

Update Firefox/ESR to the listed fixed versions immediately and enforce updates.

## References

- [other] https://bugzilla.mozilla.org/show_bug.cgi?id=2050542
- [other] https://www.mozilla.org/security/advisories/mfsa2026-100/
- [other] https://www.mozilla.org/security/advisories/mfsa2026-101/
- [other] https://www.mozilla.org/security/advisories/mfsa2026-102/
- [other] https://www.mozilla.org/security/advisories/mfsa2026-103/
- [other] https://www.mozilla.org/security/advisories/mfsa2026-97/
- [other] https://www.mozilla.org/security/advisories/mfsa2026-98/
- [other] https://www.mozilla.org/security/advisories/mfsa2026-99/

---
Summary, impact and action are written by the vulneraibility.com AI analysis pipeline from the CVE record, NVD, CISA and FIRST data; verify against the references.