CVE-2026-100811
Sandbox escape due to use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157,
CVSS
9.6
Crítico
EPSS
0.3%
p17
KEV
—
Exploit Today
5
0-100
Publicado: 29 sept 2026 · Última mod.: 5 oct 2026 · CWE-416
0.3%EPSS · 30 días0.3%
2026-09-302026-10-19
Sandbox escape due to use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, and Firefox ESR 140.17.
- bugzilla.mozilla.orghttps://bugzilla.mozilla.org/show_bug.cgi?id=2067973
- www.mozilla.orghttps://www.mozilla.org/security/advisories/mfsa2026-100/
- www.mozilla.orghttps://www.mozilla.org/security/advisories/mfsa2026-101/
- www.mozilla.orghttps://www.mozilla.org/security/advisories/mfsa2026-102/
- www.mozilla.orghttps://www.mozilla.org/security/advisories/mfsa2026-103/
- www.mozilla.orghttps://www.mozilla.org/security/advisories/mfsa2026-97/
- www.mozilla.orghttps://www.mozilla.org/security/advisories/mfsa2026-99/
CVECVSSEPSSKEVRExplotTítuloVis.
CVE-2026-114111——
———sharp before 0.35.5 bundles a librsvg dependency affected by a memory-related vulnerability (CVE-2026-96889) that, under certain runtime-specific conditions, can lead to code execution on glibc-based Linux. An attacker can supply a crafted SVG image that, when decoded by sharp through librsvg, may result in arbitrary code execution.5hCVE-2026-1140426.5 MED—
———FreeRDP 3.32.0 contains a use-after-free vulnerability in the drdynvc channel that frees a pool-owned stream with the owned-stream deallocator when totalLength is smaller than the chunk size. A malicious RDP server can send a single well-formed Virtual Channel PDU to trigger the free and crash the client during teardown.5hCVE-2026-1133448.8 ALT—
———Use after free in Performance in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)6hCVE-2026-1133398.8 ALT—
———Use after free in SVG in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)6hCVE-2026-1133388.8 ALT—
———Use after free in Turbolev in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)6hCVE-2026-1133278.8 ALT—
———Use after free in Chromecast in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)6h